Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Information

Software Type Plugin
Software Slug latepoint (view on wordpress.org)
Software Status Active
Software Author latepoint
Software Website latepoint.com
Software Downloads 1,368,859
Software Active Installs 100,000
Software Record Last Updated July 13, 2026

Showing 1-20 of 29 Vulnerabilities

Submit a Vulnerability
LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass
7.5
CVE-2026-5356
Jul 7, 2026
Researcher: Andrés Cruciani
LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step
5.3
CVE-2026-11398
Jul 2, 2026
Researcher: hhhai
LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter
5.3
CVE-2026-12657
Jul 1, 2026
Researcher: gidget smith
LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter
8.8
CVE-2026-13228
Jun 30, 2026
Researcher: d.v4n_s3c
LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
7.5
CVE-2026-8176
Jun 15, 2026
Researcher: d.v4n_s3c
LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action
4.3
CVE-2026-9719
Jun 5, 2026
Researcher: Kirasec
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation
8.8
CVE-2026-49083
Jun 5, 2026
Researcher: VanTastic
LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route
4.3
CVE-2026-5365
May 13, 2026
Researcher: Tulgaaaa
LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism
5.3
CVE-2026-7652
May 8, 2026
Researcher: Michael Iden (Mickhat)
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-7448
May 6, 2026
Researcher: AmonRa
LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
7.2
CVE-2026-7332
May 5, 2026
Researcher: lhking
LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
6.4
CVE-2026-7457
May 5, 2026
Researcher: Niv Kochan
LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability
8.8
CVE-2026-6741
Apr 27, 2026
Researchers: skyv3il, Chirita Catalin-Andrei (CC99IE), AmonRa
LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
5.3
CVE-2026-5234
Apr 16, 2026
Researcher: normaandersonfrank
LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2026-4785
Apr 7, 2026
Researcher: zaim
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
4.3
CVE-2026-32533
Mar 23, 2026
Researcher: daroo
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
6.1
CVE-2026-2324
Mar 10, 2026
Researcher: lucsob
LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import
6.5
CVE-2026-1487
Mar 2, 2026
Researcher: Chiao-Lin Yu (Steven Meow)
LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
8.8
CVE-2026-1566
Mar 2, 2026
Researcher: bashu
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery
4.3
CVE-2025-14873
Feb 13, 2026
Researcher: Moose Love
Title Status CVE ID CVSS Researchers Date
LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass Patched CVE-2026-5356 7.5 Andrés Cruciani July 7, 2026
LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step Patched CVE-2026-11398 5.3 hhhai July 2, 2026
LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter Patched CVE-2026-12657 5.3 gidget smith July 1, 2026
LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter Patched CVE-2026-13228 8.8 d.v4n_s3c June 30, 2026
LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset Patched CVE-2026-8176 7.5 d.v4n_s3c June 15, 2026
LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action Patched CVE-2026-9719 4.3 Kirasec June 5, 2026
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation Patched CVE-2026-49083 8.8 VanTastic June 5, 2026
LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route Patched CVE-2026-5365 4.3 Tulgaaaa May 13, 2026
LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism Patched CVE-2026-7652 5.3 Michael Iden (Mickhat) May 8, 2026
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-7448 7.2 AmonRa May 6, 2026
LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter Patched CVE-2026-7332 7.2 lhking May 5, 2026
LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update Patched CVE-2026-7457 6.4 Niv Kochan May 5, 2026
LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability Patched CVE-2026-6741 8.8 skyv3il, Chirita Catalin-Andrei (CC99IE), AmonRa April 27, 2026
LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID Patched CVE-2026-5234 5.3 normaandersonfrank April 16, 2026
LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2026-4785 6.4 zaim April 7, 2026
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference Patched CVE-2026-32533 4.3 daroo March 23, 2026
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting Patched CVE-2026-2324 6.1 lucsob March 10, 2026
LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import Patched CVE-2026-1487 6.5 Chiao-Lin Yu (Steven Meow) March 2, 2026
LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation Patched CVE-2026-1566 8.8 bashu March 2, 2026
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery Patched CVE-2025-14873 4.3 Moose Love February 13, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation