latepoint

Records48All Threatist records

Exploited (KEV)0None in CISA KEV

CVSS critical6CVSS 9.0–10.0

CVSS high15CVSS 7.0–8.9

Exploited now

latepoint records in CISA KEV

No latepoint vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records

Latepoint 5 records MEDIUM

Records

48 records

TI-2024-08303 CVE-2024-8943 · GHSA-jwc3-mm8j-j745

LatePoint <= 5.0.12 - Authentication Bypass

MEDIUM 54

The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0308 Published 2024-10-08 No fix listed CWE-288

TI-2024-08274 CVE-2024-8911 · GHSA-pg6c-99q5-3xqp

LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection

MEDIUM 54

The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02904 Published 2024-10-08 No fix listed CWE-89

TI-2026-62628 CVE-2026-92966 · GHSA-cgqj-c6wx-f7r6

Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

MEDIUM 48

The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00712 Published 2026-10-01 No fix listed CWE-94

TI-2024-02298 CVE-2024-2472 · GHSA-c2xh-vr49-pcp6

LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR

MEDIUM 48

The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_customer' function in all versions up to…

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00623 Published 2024-06-14 No fix listed CWE-639

TI-2026-76047 CVE-2026-110653 · GHSA-3xwr-ghgc-2994

Race condition in LatePoint plugin allows authentication bypass

MEDIUM 47

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00403 Published 2026-10-17 No fix listed CWE-287

TI-2026-41538 CVE-2026-57714 · GHSA-5mpv-xh3v-4348

WordPress LatePoint plugin <= 5.6.3 - SQL Injection vulnerability

MEDIUM 46

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects LatePoint: from n/a through <= 5.6.3.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.004 Published 2026-07-13 No fix listed CWE-89

TI-2026-11232 CVE-2026-13228 · GHSA-9xqc-qhp9-fr5q

LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter

MEDIUM 41

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.6.3 This is due to an Insecure Direct Ob…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00577 Published 2026-07-01 No fix listed CWE-269

TI-2026-70262 CVE-2026-104766 · GHSA-h977-fppf-xgg7

Privilege escalation in LatePoint plugin for WordPress

MEDIUM 40

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00293 Published 2026-10-10 No fix listed CWE-269

TI-2026-05906 CVE-2026-6741 · GHSA-hh48-8rfg-4422

Improper privilege management in LatePoint – Calendar Booking Plugin for Appointments and…

MEDIUM 40

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation in versions up to and including 5.4.1.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00293 Published 2026-04-27 No fix listed CWE-269

TI-2026-01255 CVE-2026-1566 · GHSA-5hqh-wqmh-6mq8

LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation

MEDIUM 40

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to privilege escalation via password reset in all versions up to, and including, 5.2.7.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00342 Published 2026-03-02 No fix listed CWE-269

TI-2026-73808 CVE-2026-103366 · GHSA-3pf7-5297-2ffv

Insecure object reference in LatePoint lets anyone read bookings

LOW 39

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `c…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00475 Published 2026-10-14 No fix listed CWE-639

TI-2026-70208 CVE-2026-96662 · GHSA-mwwp-rchw-pr78

SQL injection in LatePoint Appointment Booking Plugin for WordPress

LOW 39

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00387 Published 2026-10-10 No fix listed CWE-89

TI-2026-04687 CVE-2026-5356 · GHSA-jrp6-4xgv-3wr7

Missing authorization in LatePoint – Calendar Booking Plugin for Appointments and Events

LOW 39

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Improper Input Validation in all versions up to, and including, 5.4.0.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00361 Published 2026-07-08 No fix listed CWE-862

TI-2026-06438 CVE-2026-7332 · GHSA-97wr-3wr5-r6wx

LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter

LOW 38

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_form_page_url' parameter in all versions up to, and including, 5.5.0…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.0045 Published 2026-05-06 No fix listed CWE-79

TI-2026-00417 CVE-2026-0617 · GHSA-pc2q-5vm7-7wv7

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting

LOW 38

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer profile fields in all versions up to, and including, 5.2.5 due to ins…

CVSS 3.1HIGH 7.2 Network No auth No interaction EPSS 0.00403 Published 2026-02-03 No fix listed CWE-79

TI-2024-29534 CVE-2024-43945 · GHSA-8273-cqw8-3w74

WordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerability

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.This issue affects LatePoint: from n/a through 4.9.91.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00262 Published 2024-10-21 No fix listed CWE-352

TI-2025-06415 CVE-2025-7052 · GHSA-xrx7-7p6r-q95g

LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function

LOW 37

The LatePoint plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.1.94.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00218 Published 2025-09-30 No fix listed CWE-352

TI-2025-06403 CVE-2025-7038 · GHSA-48wv-cp4q-qcjc

LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function

LOW 36

The LatePoint plugin for WordPress is vulnerable to Authentication Bypass due to insufficient identity verification within the steps__load_step route of the latepoint_route_call AJAX endpoint in all versions up to, and i…

CVSS 3.1HIGH 8.2 Network No auth No interaction EPSS 0.0041 Published 2025-09-30 No fix listed CWE-288

TI-2026-73801 CVE-2026-100163 · GHSA-fwf2-rqrw-2q37

Authentication bypass in LatePoint plugin allows customer takeover

LOW 35

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_use…

CVSS 3.1HIGH 7.4 Network No auth No interaction EPSS 0.00431 Published 2026-10-14 No fix listed CWE-287

TI-2026-36309 CVE-2026-49083 · GHSA-2prc-85pp-97r9

WordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerability

LOW 35

Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00344 Published 2026-06-15 No fix listed CWE-266

TI-2026-07198 CVE-2026-8176 · GHSA-2pxw-w9w5-c6hm

Improper privilege management in LatePoint – Calendar Booking Plugin for Appointments and…

LOW 35

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Privilege Escalation to Administrator in versions up to, and including, 5.5.1.

CVSS 3.1HIGH 7.5 Network Low privileges No interaction EPSS 0.00472 Published 2026-06-16 No fix listed CWE-269

TI-2026-25061 CVE-2026-32533 · GHSA-4w94-x732-jcmm

WordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerability

LOW 34

Authorization Bypass Through User-Controlled Key vulnerability in LatePoint LatePoint latepoint allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects LatePoint: from n/a through <= 5.…

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00176 Published 2026-03-25 No fix listed CWE-639

TI-2026-10835 CVE-2026-12657 · GHSA-p2v5-84j7-pc37

LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter

LOW 31

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.2 via the 'service_id' parameter due to…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00671 Published 2026-07-02 No fix listed CWE-639

TI-2026-01184 CVE-2026-1487 · GHSA-grpv-jwmg-2qjv

LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import

LOW 31

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to SQL Injection via the JSON Import in all versions up to, and including, 5.2.7 due to insufficient validation on th…

CVSS 3.1MEDIUM 6.5 Network High privileges No interaction EPSS 0.00366 Published 2026-03-03 No fix listed CWE-89

TI-2026-65936 CVE-2026-94432 · GHSA-9rc5-84g4-qhvh

Authorization bypass in latepoint Appointment Booking Plugin – LatePoint | Calendar &…

LOW 30

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00266 Published 2026-10-02 No fix listed CWE-639

Open these records in search →