Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Wordfence Intelligence   >   Vulnerability Database   >   WordPress Plugins   >   Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Information

Software Type Plugin
Software Slug latepoint (view on wordpress.org)
Software Status Active
Software Author latepoint
Software Website latepoint.com
Software Downloads 1,475,106
Software Active Installs 100,000
Software Record Last Updated August 18, 2026

Showing 1-20 of 32 Vulnerabilities

Submit a Vulnerability
LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion
9.8
CVE-2025-6715
Jul 23, 2025
Researcher: wesley (wcraft)
LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter
8.8
CVE-2026-13228
Jun 30, 2026
Researcher: d.v4n_s3c
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation
8.8
CVE-2026-49083
Jun 5, 2026
Researcher: VanTastic
LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability
8.8
CVE-2026-6741
Apr 27, 2026
Researchers: skyv3il, Chirita Catalin-Andrei (CC99IE), AmonRa
LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
8.8
CVE-2026-1566
Mar 2, 2026
Researcher: bashu
LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function
8.8
CVE-2025-7052
Sep 29, 2025
Researcher: wesley (wcraft)
LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function
8.2
CVE-2025-7038
Sep 29, 2025
Researcher: wesley (wcraft)
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection
7.5
CVE-2026-57714
Jul 8, 2026
Researcher: daroo
LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass
7.5
CVE-2026-5356
Jul 7, 2026
Researcher: Andrés Cruciani
LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
7.5
CVE-2026-8176
Jun 15, 2026
Researcher: d.v4n_s3c
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-7448
May 6, 2026
Researcher: AmonRa
LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
7.2
CVE-2026-7332
May 5, 2026
Researcher: lhking
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting
7.2
CVE-2026-0617
Feb 2, 2026
Researcher: w41bu1
LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import
6.5
CVE-2026-1487
Mar 2, 2026
Researcher: Chiao-Lin Yu (Steven Meow)
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes
6.4
CVE-2026-5391
Aug 5, 2026
Researcher: alex_henry20
LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
6.4
CVE-2026-7457
May 5, 2026
Researcher: Niv Kochan
LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2026-4785
Apr 7, 2026
Researcher: zaim
LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2025-6941
Sep 29, 2025
Researcher: Muhammad Yudha - DJ
LatePoint <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-30836
Mar 27, 2025
Researcher: Peter Thaleikis
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
6.1
CVE-2026-2324
Mar 10, 2026
Researcher: lucsob
Title Status CVE ID CVSS Researchers Date
LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion Patched CVE-2025-6715 9.8 wesley (wcraft) July 23, 2025
LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter Patched CVE-2026-13228 8.8 d.v4n_s3c June 30, 2026
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation Patched CVE-2026-49083 8.8 VanTastic June 5, 2026
LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability Patched CVE-2026-6741 8.8 skyv3il, Chirita Catalin-Andrei (CC99IE), AmonRa April 27, 2026
LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation Patched CVE-2026-1566 8.8 bashu March 2, 2026
LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function Patched CVE-2025-7052 8.8 wesley (wcraft) September 29, 2025
LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function Patched CVE-2025-7038 8.2 wesley (wcraft) September 29, 2025
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection Patched CVE-2026-57714 7.5 daroo July 8, 2026
LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass Patched CVE-2026-5356 7.5 Andrés Cruciani July 7, 2026
LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset Patched CVE-2026-8176 7.5 d.v4n_s3c June 15, 2026
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-7448 7.2 AmonRa May 6, 2026
LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter Patched CVE-2026-7332 7.2 lhking May 5, 2026
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting Patched CVE-2026-0617 7.2 w41bu1 February 2, 2026
LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import Patched CVE-2026-1487 6.5 Chiao-Lin Yu (Steven Meow) March 2, 2026
LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes Patched CVE-2026-5391 6.4 alex_henry20 August 5, 2026
LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update Patched CVE-2026-7457 6.4 Niv Kochan May 5, 2026
LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2026-4785 6.4 zaim April 7, 2026
LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Patched CVE-2025-6941 6.4 Muhammad Yudha - DJ September 29, 2025
LatePoint <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting Patched CVE-2025-30836 6.4 Peter Thaleikis March 27, 2025
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting Patched CVE-2026-2324 6.1 lucsob March 10, 2026

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation