LC
Product
LatePoint – Calendar Booking Plugin for Appointments and Events
24
CVEs
0
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 9Medium 15Low 0
Watch
Add LatePoint – Calendar Booking Plugin for Appointments and Events to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-1487 | 6.5 | Mar 3 | LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import Affected: through 5.2.7 |
| CVE-2026-7457 | 6.4 | May 6 | LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update Affected: through 5.5.0 |
| CVE-2026-4785 | 6.4 | Apr 8 | LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 5.3.0 |
| CVE-2025-6941 | 6.4 | Sep 30 | LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 5.1.94 |
| CVE-2026-2324 | 6.1 | Mar 11 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting Affected: through 5.2.7 |
| CVE-2025-6815 | 5.5 | Sep 30 | LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting Affected: through 5.1.94 |
| CVE-2026-11398 | 5.3 | Jul 3 | LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step Affected: through 5.6.1 |
| CVE-2026-12657 | 5.3 | Jul 2 | LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter Affected: through 5.6.2 |
| CVE-2026-7652 | 5.3 | May 9 | LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism Affected: through 5.5.0 |
| CVE-2026-5234 | 5.3 | Apr 17 | LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID Affected: through 5.3.2 |
| CVE-2026-1537 | 5.3 | Feb 12 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure Affected: through 5.2.6 |
| CVE-2025-3769 | 5.3 | May 14 | Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference Affected: through 5.1.92 |
| CVE-2026-9719 | 4.3 | Jun 5 | LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action Affected: through 5.6.0 |
| CVE-2026-5365 | 4.3 | May 14 | LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route Affected: through 5.3.2 |
| CVE-2025-14873 | 4.3 | Feb 14 | LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery Affected: through 5.2.5 |
Showing 15