Latepoint vulnerabilities
49 CVEs and advisories name Latepoint as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-4785LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2026-32533WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability
- CVE-2026-2324LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
- CVE-2026-1487LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import
- CVE-2026-1566LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
- CVE-2025-14873LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery
- CVE-2026-1537LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure
- CVE-2026-0617LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting
- CVE-2025-7052LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function
- CVE-2025-7038LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function
- CVE-2025-6941LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- CVE-2025-6815LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting
- CVE-2025-3769Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference
- CVE-2025-30836WordPress LatePoint plugin <= 5.1.6 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-43945WordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability
- CVE-2024-8943LatePoint <= 5.0.12 - Authentication Bypass
- CVE-2024-8911LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection
- CVE-2024-43992WordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerability
- CVE-2024-2472LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR