Vulnerabilities in LatePoint
49 resultsCVE-2026-119152MEDIUMAppointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email FieldEPSS 0.2%CVE-2025-7052HIGHLatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() FunctionEPSS 0.2%CVE-2026-91050MEDIUMAppointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' ParameterEPSS 0.2%CVE-2026-9719MEDIUMLatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status ActionEPSS 0.2%CVE-2026-32533MEDIUMWordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.2%CVE-2025-14873MEDIUMLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request ForgeryEPSS 0.2%CVE-2026-17538MEDIUMAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII ModificationEPSS 0.2%CVE-2026-2324MEDIUMLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site ScriptingEPSS 0.1%CVE-2026-5365MEDIUMLatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX RouteEPSS 0.1%