LatePoint – Calendar Booking Plugin for Appointments and Events

Güvenlik açıkları

• CVE-2026-57714

  WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability

  Kritik 9.3

• CVE-2026-92966

  Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

  Kritik 9.1

• CVE-2026-13228

  LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter

  Yüksek 8.8

• CVE-2026-6741

  LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability

  Yüksek 8.8

• CVE-2025-7052

  LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function

  Yüksek 8.8

• CVE-2024-43945

  WordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability

  Yüksek 8.8

• CVE-2025-7038

  LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function

  Yüksek 8.2

• CVE-2026-5356

  LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass

  Yüksek 7.5

• CVE-2026-8176

  LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Ca

  Yüksek 7.5

• CVE-2026-49083

  WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

  Yüksek 7.5

• CVE-2026-7332

  LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter

  Yüksek 7.2

• CVE-2026-0617

  LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting

  Yüksek 7.2

• CVE-2026-32533

  WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability

  Orta 6.5

• CVE-2025-30836

  WordPress LatePoint plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability

  Orta 6.5

• CVE-2026-5391

  LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

  Orta 6.4

• CVE-2026-7457

  LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update

  Orta 6.4

• CVE-2026-4785

  LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 6.4

• CVE-2025-6941

  LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

  Orta 6.4

• CVE-2026-2324

  LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scrip

  Orta 6.1

• CVE-2025-6815

  LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting

  Orta 5.5

• CVE-2024-43992

  WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerability

  Orta 5.4

• CVE-2026-11398

  LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step

  Orta 5.3

• CVE-2026-12657

  LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter

  Orta 5.3

• CVE-2026-7652

  LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism

  Orta 5.3

• CVE-2026-5234

  LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID

  Orta 5.3

• CVE-2026-1537

  LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure

  Orta 5.3

• CVE-2025-3769

  Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference

  Orta 5.3

• CVE-2026-13471

  LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities R

  Orta 4.3

• CVE-2026-18441

  LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]'

  Orta 4.3

• CVE-2026-9719

  LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action

  Orta 4.3

• CVE-2026-5365

  LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route

  Orta 4.3

• CVE-2025-14873

  LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery

  Orta 4.3