Vulnerabilities in latepoint

36 results
Vexday analysis

Latepoint acumula 27 vulnerabilidades, com 11 publicadas nos últimos 90 dias, indicando ritmo recente de descobertas; nenhuma está sob ataque ativo no momento, mas 3 críticas demandam atenção. A fraqueza dominante é injeção de código (CWE-79), típica de aplicações web, o que amplifica o risco de exposição em ambientes conectados.

CVE-2026-49083HIGHWordPress LatePoint plugin <= 5.5.1 - Privilege Escalation vulnerabilityEPSS 0.3%CVE-2026-1487MEDIUMLatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON ImportEPSS 0.3%CVE-2026-1566HIGHLatePoint <= 5.2.7 - Authenticated (Agent+) Privilege EscalationEPSS 0.3%CVE-2026-32533MEDIUMWordPress LatePoint plugin <= 5.2.6 - Insecure Direct Object References (IDOR) vulnerabilityEPSS 0.3%CVE-2026-5391MEDIUMLatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode AttributesEPSS 0.3%CVE-2025-6815MEDIUMLatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site ScriptingEPSS 0.3%CVE-2024-43992MEDIUMWordPress LatePoint plugin <= 4.9.91 - Cross Site Scripting (XSS) vulnerabilityEPSS 0.3%CVE-2026-1537MEDIUMLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details ExposureEPSS 0.3%CVE-2025-6941MEDIUMLatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via ShortcodeEPSS 0.2%CVE-2024-43945MEDIUMWordPress LatePoint plugin <= 4.9.91 - Cross Site Request Forgery (CSRF) vulnerabilityEPSS 0.2%CVE-2026-18441MEDIUMLatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' ParameterEPSS 0.2%CVE-2025-7052HIGHLatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() FunctionEPSS 0.2%CVE-2026-9719MEDIUMLatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status ActionEPSS 0.2%CVE-2026-5365MEDIUMLatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX RouteEPSS 0.2%CVE-2025-14873MEDIUMLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request ForgeryEPSS 0.1%CVE-2026-2324MEDIUMLatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site ScriptingEPSS 0.1%