VulnCrest
Search
Create account
Report an incident
Radar sectionsPlugins & themes
Check my site

WordPress plugin

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress security & vulnerabilities

latepoint— active installsLast vulnerability Nov 6, 2026

Unpatched vulnerability in the latest version

At least one vulnerability affects the latest version and no fix has been released. Deactivate the plugin or restrict access to the affected feature until the vendor ships a patch.

Watch plugin
59Known vulnerabilities
  • Critical7
  • High16
  • Medium35
  • Low1
Vulnerabilities per year
2024: 5 vulnerabilities5242025: 7 vulnerabilities7252026: 47 vulnerabilities4726

All Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerabilities

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerabilities
SeverityVulnerabilityCVEPublished
Critical9.1Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter
≤5.7.6Update to 5.7.7
CVE-2026-118066
Medium5.4Unauthenticated Stored Cross-Site Scripting via Customer Email Field
≤5.7.6Update to 5.7.7
CVE-2026-119152
Medium4.4Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.7.5Update to 5.7.6
CVE-2026-105258
Medium5.3Unauthenticated Payment Bypass
≤5.7.4Update to 5.7.5
CVE-2026-105256
Medium4.3Authenticated (Agent+) Insecure Direct Object Reference
≤5.7.4Update to 5.7.5
CVE-2026-105257
Low3.7Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter
≤5.7.4Update to 5.7.5
CVE-2026-111602
Critical9.1Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter
≤5.7.4Update to 5.7.5
CVE-2026-110653
High7.4Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback
≤5.7.2Update to 5.7.3
CVE-2026-100163
High7.5Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters
≤5.7.3Update to 5.7.4
CVE-2026-103366
Medium4.3Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion
≤5.7.3Update to 5.7.4
CVE-2026-103380
High7.5Unauthenticated SQL Injection via 'booking[service_id]' Parameter
≤5.7.2Update to 5.7.3
CVE-2026-96662
High8.8Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter
≤5.7.3Update to 5.7.4
CVE-2026-104766
Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter
≤5.7.2Update to 5.7.3
CVE-2026-91050
Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
<5.6.9Update to 5.6.9
CVE-2026-105196
Medium4.3Authenticated (Custom Role+) Insecure Direct Object Reference
<5.6.5Update to 5.6.5
CVE-2026-105197
Medium5.3Unauthenticated Insecure Direct Object Reference
<5.7.3Update to 5.7.3
CVE-2026-105198
Medium5.4Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification
≤5.6.9Update to 5.6.10
CVE-2026-17538
Medium5.3Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter
≤5.7.1Update to 5.7.2
CVE-2026-94432
Critical9.1Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field
≤5.7.0Update to 5.7.1
CVE-2026-92966
Medium4.3Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)
≤5.6.3Update to 5.6.4
CVE-2026-13471
Medium4.3Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter
≤5.6.9Update to 5.6.10
CVE-2026-18441
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
≤5.3.2Update to 5.4.0
CVE-2026-5391
Medium5.3Missing Authorization to Unauthenticated Booking Object Mass Assignment
≤5.6.7Update to 5.6.8
CVE-2026-15250
High7.5Unauthenticated SQL Injection
≤5.6.3Update to 5.6.4
CVE-2026-57714
High7.5Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass
≤5.4.0Update to 5.4.1
CVE-2026-5356
Medium5.3Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step
≤5.6.1Update to 5.6.2
CVE-2026-11398
Medium5.3Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter
≤5.6.2Update to 5.6.3
CVE-2026-12657
High8.8Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter
≤5.6.3Update to 5.6.4
CVE-2026-13228
Medium4.3Cross-Site Request Forgery
≤5.6.2Update to 5.6.3
CVE-2026-11866
High7.5Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
≤5.5.1Update to 5.5.2
CVE-2026-8176
Medium4.3Cross-Site Request Forgery via invoices__change_status Action
≤5.6.0Update to 5.6.1
CVE-2026-9719
High8.8Authenticated (Contributor+) Privilege Escalation
≤5.5.1Update to 5.5.2
CVE-2026-49083
Medium4.3Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route
≤5.3.2Update to 5.4.0
CVE-2026-5365
Medium5.3Unauthenticated Account Takeover via Weak Password Recovery Mechanism
≤5.5.0Update to 5.5.1
CVE-2026-7652
High7.2Unauthenticated Stored Cross-Site Scripting
≤5.5.0Update to 5.5.1
CVE-2026-7448
High7.2Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
≤5.5.0Update to 5.5.1
CVE-2026-7332
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
≤5.5.0Update to 5.5.1
CVE-2026-7457
High8.8Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability
≤5.4.1Update to 5.4.2
CVE-2026-6741
Medium5.3Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
≤5.3.2Update to 5.4.0
CVE-2026-5234
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤5.3.0Update to 5.3.1
CVE-2026-4785
Medium4.3Authenticated (Subscriber+) Insecure Direct Object Reference
≤5.2.6Update to 5.2.7
CVE-2026-32533
Medium6.1Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
≤5.2.7Update to 5.2.8
CVE-2026-2324
Medium6.5Authenticated (Administrator+) SQL Injection via JSON Import
≤5.2.7Update to 5.2.8
CVE-2026-1487
High8.8Authenticated (Agent+) Privilege Escalation
≤5.2.7Update to 5.2.8
CVE-2026-1566
Medium4.3Cross-Site Request Forgery
≤5.2.5Update to 5.2.6
CVE-2025-14873
Medium5.3Missing Authorization to Booking Details Exposure
≤5.2.6Update to 5.2.7
CVE-2026-1537
High7.2Unauthenticated Stored Cross-Site Scripting
≤5.2.5Update to 5.2.6
CVE-2026-0617
High8.2Unauthenticated Authentication Bypass via load_step Function
≤5.1.94Update to 5.2.0
CVE-2025-7038
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
≤5.1.94Update to 5.2.0
CVE-2025-6941
High8.8Cross-Site Request Forgery to Account Takeover via change_password() Function
≤5.1.94Update to 5.2.0
CVE-2025-7052
Medium5.5Authenticated (Administrator+) Stored Cross-Site Scripting
≤5.1.94Update to 5.2.0
CVE-2025-6815
Critical9.8Unauthenticated Local File Inclusion
≤5.1.93Update to 5.1.94
CVE-2025-6715
Medium5.3Unauthenticated Insecure Direct Object Reference
≤5.1.92Update to 5.1.93
CVE-2025-3769
Medium6.4Authenticated (Contributor+) Stored Cross-Site Scripting
≤5.1.6Update to 5.1.7
CVE-2025-30836
Critical9.8Authentication Bypass
≤5.0.12Update to 5.0.13
CVE-2024-8943
Critical9.8Unauthenticated Arbitrary User Password Change via SQL Injection
≤5.0.11Update to 5.0.12
CVE-2024-8911
Medium6.4Authenticated (Subscriber+) Stored Cross-Site Scripting
≤4.9.91No patch available
CVE-2024-43992
Medium4.3Cross-Site Request Forgery
≤4.9.91No patch available
CVE-2024-43945
Critical9.1Missing Authorization and Sensitive Information Exposure via IDOR
≤4.9.9Update to 4.9.9.1
CVE-2024-2472

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: common questions

Does Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress have known vulnerabilities?

Yes. VulnCrest Radar lists 59 known vulnerabilities in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress: 7 critical, 16 high, 35 medium, 1 low. At least one is not fixed in the latest version.

How do I check which version of Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress I run?

In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.

What is the most recent Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerability?

CVE-2026-118066, published Nov 6, 2026: Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter. Severity: Critical (CVSS 9.1).

Is any Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerability listed in CISA KEV?

No. None of the known Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerabilities is currently listed in the CISA KEV catalog.

Search VulnCrest Radar

Jump to

Are you sure?