LatePoint LatePoint – Calendar Booking Plugin for Appointments and Events

• CVE-2026-5356 High 7.5 LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass 0.4%
• CVE-2026-11398 Medium 5.3 LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step 0.6%
• CVE-2026-12657 Medium 5.3 LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter 0.7%
• CVE-2026-13228 High 8.8 LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter 0.6%
• CVE-2026-8176 High 7.5 LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset 0.5%
• CVE-2026-9719 Medium 4.3 LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action 0.2%
• CVE-2026-5365 Medium 4.3 LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route 0.1%
• CVE-2026-7652 Medium 5.3 LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism 0.7%
• CVE-2026-7332 High 7.2 LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter 0.4%
• CVE-2026-7457 Medium 6.4 LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update 0.3%
• CVE-2026-6741 High 8.8 LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability 0.3%
• CVE-2026-5234 Medium 5.3 LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID 0.7%
• CVE-2026-4785 Medium 6.4 LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.4%
• CVE-2026-2324 Medium 6.1 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting 0.1%
• CVE-2026-1487 Medium 6.5 LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import 0.4%
• CVE-2026-1566 High 8.8 LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation 0.3%
• CVE-2025-14873 Medium 4.3 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery 0.2%
• CVE-2026-1537 Medium 5.3 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure 0.3%
• CVE-2026-0617 High 7.2 LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting 0.4%
• CVE-2025-7052 High 8.8 LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function 0.2%
• CVE-2025-7038 High 8.2 LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function 0.4%
• CVE-2025-6941 Medium 6.4 LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode 0.3%
• CVE-2025-6815 Medium 5.5 LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting 0.3%
• CVE-2025-3769 Medium 5.3 Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference 0.4%