# cve.now: Latepoint

The newest entries naming Latepoint as an affected vendor (up to 200), of 49 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-118066](https://cve.now/CVE-2026-118066.md): Appointment Booking Plugin \<= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in… (CVSS 9.1)
- [CVE-2026-119152](https://cve.now/CVE-2026-119152.md): Appointment Booking Plugin \<= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field (CVSS 5.4)
- [CVE-2026-111602](https://cve.now/CVE-2026-111602.md): Appointment Booking Plugin \<= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer\[uuid\]' Parameter (CVSS 3.7)
- [CVE-2026-110653](https://cve.now/CVE-2026-110653.md): Appointment Booking Plugin \<= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter (CVSS 9.1)
- [CVE-2026-103380](https://cve.now/CVE-2026-103380.md): Appointment Booking Plugin \<= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first\_name' Parameter Template Re-expansion (CVSS 4.3)
- [CVE-2026-103366](https://cve.now/CVE-2026-103366.md): Appointment Booking Plugin \<= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking\[id\]' and 'cart\[id\]' Parameters (CVSS 7.5)
- [CVE-2026-100163](https://cve.now/CVE-2026-100163.md): Appointment Booking Plugin \<= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create\_wp\_user\_for\_customer() username\_exists Fallback (CVSS 7.4)
- [CVE-2026-96662](https://cve.now/CVE-2026-96662.md): Appointment Booking Plugin \<= 5.7.2 - Unauthenticated SQL Injection via 'booking\[service\_id\]' Parameter (CVSS 7.5)
- [CVE-2026-104766](https://cve.now/CVE-2026-104766.md): Appointment Booking Plugin \<= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings\[default\_wp\_role\_for\_customer\]' Parameter (CVSS 8.8)
- [CVE-2026-91050](https://cve.now/CVE-2026-91050.md): Appointment Booking Plugin \<= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params\[presets\]\[order\_item\_id\]' Parameter (CVSS 4.3)
- [CVE-2026-17538](https://cve.now/CVE-2026-17538.md): Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress \<= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification (CVSS 5.4)
- [CVE-2026-94432](https://cve.now/CVE-2026-94432.md): Appointment Booking Plugin \<= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice\_id' Parameter (CVSS 5.3)
- [CVE-2026-92966](https://cve.now/CVE-2026-92966.md): Appointment Booking Plugin \<= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field (CVSS 9.1)
- [CVE-2026-13471](https://cve.now/CVE-2026-13471.md): LatePoint \<= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking) (CVSS 4.3)
- [CVE-2026-18441](https://cve.now/CVE-2026-18441.md): LatePoint - Appointment Booking & Scheduling \<= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer\[id\]' Parameter (CVSS 4.3)
- [CVE-2026-5391](https://cve.now/CVE-2026-5391.md): LatePoint \<= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes (CVSS 6.4)
- [CVE-2026-57714](https://cve.now/CVE-2026-57714.md): WordPress LatePoint plugin \<= 5.6.3 - SQL Injection vulnerability (CVSS 9.3)
- [CVE-2026-5356](https://cve.now/CVE-2026-5356.md): LatePoint - Calendar Booking Plugin for Appointments and Events \<= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass (CVSS 7.5)
- [CVE-2026-11398](https://cve.now/CVE-2026-11398.md): LatePoint \<= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process\_step\_customer() Booking Form Customer Step (CVSS 5.3)
- [CVE-2026-12657](https://cve.now/CVE-2026-12657.md): LatePoint \<= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service\_id' Parameter (CVSS 5.3)
- [CVE-2026-13228](https://cve.now/CVE-2026-13228.md): LatePoint \<= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order\[customer\_id\]' Parameter (CVSS 8.8)
- [CVE-2026-8176](https://cve.now/CVE-2026-8176.md): LatePoint \<= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create\_or\_update + Unauthenticated Customer-Cabinet Password Reset (CVSS 7.5)
- [CVE-2026-49083](https://cve.now/CVE-2026-49083.md): WordPress LatePoint plugin \<= 5.5.1 - Privilege Escalation vulnerability (CVSS 7.5)
- [CVE-2026-9719](https://cve.now/CVE-2026-9719.md): LatePoint \<= 5.6.0 - Cross-Site Request Forgery via invoices\_\_change\_status Action (CVSS 4.3)
- [CVE-2026-5365](https://cve.now/CVE-2026-5365.md): LatePoint \<= 5.3.2 - Cross-Site Request Forgery via 'customer\_cabinet\_\_request\_cancellation' AJAX Route (CVSS 4.3)
- [CVE-2026-7652](https://cve.now/CVE-2026-7652.md): LatePoint \<= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism (CVSS 5.3)
- [CVE-2026-7332](https://cve.now/CVE-2026-7332.md): LatePoint \<= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking\_form\_page\_url' Parameter (CVSS 7.2)
- [CVE-2026-7457](https://cve.now/CVE-2026-7457.md): LatePoint \<= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update (CVSS 6.4)
- [CVE-2026-6741](https://cve.now/CVE-2026-6741.md): LatePoint \<= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability (CVSS 8.8)
- [CVE-2026-5234](https://cve.now/CVE-2026-5234.md): LatePoint \<= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID (CVSS 5.3)
- [CVE-2026-4785](https://cve.now/CVE-2026-4785.md): LatePoint \<= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2026-32533](https://cve.now/CVE-2026-32533.md): WordPress LatePoint plugin \<= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability (CVSS 6.5)
- [CVE-2026-2324](https://cve.now/CVE-2026-2324.md): LatePoint – Calendar Booking Plugin for Appointments and Events \<= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting (CVSS 6.1)
- [CVE-2026-1487](https://cve.now/CVE-2026-1487.md): LatePoint \<= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import (CVSS 6.5)
- [CVE-2026-1566](https://cve.now/CVE-2026-1566.md): LatePoint \<= 5.2.7 - Authenticated (Agent+) Privilege Escalation (CVSS 8.8)
- [CVE-2025-14873](https://cve.now/CVE-2025-14873.md): LatePoint – Calendar Booking Plugin for Appointments and Events \<= 5.2.5 - Cross-Site Request Forgery (CVSS 4.3)
- [CVE-2026-1537](https://cve.now/CVE-2026-1537.md): LatePoint – Calendar Booking Plugin for Appointments and Events \<= 5.2.6 - Missing Authorization to Booking Details Exposure (CVSS 5.3)
- [CVE-2026-0617](https://cve.now/CVE-2026-0617.md): LatePoint – Calendar Booking Plugin for Appointments and Events \<= 5.2.5 - Unauthenticated Stored Cross-Site Scripting (CVSS 7.2)
- [CVE-2025-7052](https://cve.now/CVE-2025-7052.md): LatePoint \<= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change\_password() Function (CVSS 8.8)
- [CVE-2025-7038](https://cve.now/CVE-2025-7038.md): LatePoint \<= 5.1.94 - Unauthenticated Authentication Bypass via load\_step Function (CVSS 8.2)
- [CVE-2025-6941](https://cve.now/CVE-2025-6941.md): LatePoint \<= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-6815](https://cve.now/CVE-2025-6815.md): LatePoint \<= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting (CVSS 5.5)
- [CVE-2025-3769](https://cve.now/CVE-2025-3769.md): Latepoint \<= 5.1.92 - Unauthenticated Insecure Direct Object Reference (CVSS 5.3)
- [CVE-2025-30836](https://cve.now/CVE-2025-30836.md): WordPress LatePoint plugin \<= 5.1.6 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-43945](https://cve.now/CVE-2024-43945.md): WordPress LatePoint plugin \<= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability (CVSS 6.5)
- [CVE-2024-8943](https://cve.now/CVE-2024-8943.md): LatePoint \<= 5.0.12 - Authentication Bypass (CVSS 9.8)
- [CVE-2024-8911](https://cve.now/CVE-2024-8911.md): LatePoint \<= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection (CVSS 9.8)
- [CVE-2024-43992](https://cve.now/CVE-2024-43992.md): WordPress LatePoint plugin \<= 4.9.91 - Cross Site Scripting (XSS) vulnerability (CVSS 6.5)
- [CVE-2024-2472](https://cve.now/CVE-2024-2472.md): LatePoint Plugin \<= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR (CVSS 9.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/latepoint
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.