Appointment Booking Plugin Latepoint Calendar Scheduling For Wordpress

WordPress plugin · appointment-booking-plugin-latepoint-calendar-scheduling-for-wordpress · WordPress.org ↗

Critical

High

Known total

Unfixed

Running Appointment Booking Plugin Latepoint Calendar Scheduling For Wordpress on your site? WP Alerts checks your installed version against every entry below and emails you only when one affects you. Free, no tracking.

Scan a site Monitor my sites →

Severity	Vulnerability	Affected	Fixed in	CVE	Published
CRITICAL CVSS 9.1	Appointment Booking Plugin <= 5.7.4 - Unauthenticated Authentication Bypass via Race Condition on OTP Attempts Counter CVE.org	<=5.7.4	unfixed	CVE-2026-110653	Oct 17, 2026
CRITICAL CVSS 9.1	Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field CVE.org	<=5.7.0	unfixed	CVE-2026-92966	Oct 1, 2026
HIGH CVSS 7.4	Appointment Booking Plugin <= 5.7.2 - Unauthenticated Authentication Bypass to Customer Account Takeover via Insufficient Verification in create_wp_user_for_customer() username_exists Fallback CVE.org	<=5.7.2	unfixed	CVE-2026-100163	Oct 14, 2026
HIGH CVSS 7.5	Appointment Booking Plugin <= 5.7.3 - Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure via 'booking[id]' and 'cart[id]' Parameters CVE.org	<=5.7.3	unfixed	CVE-2026-103366	Oct 14, 2026
HIGH CVSS 7.5	Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter CVE.org	<=5.7.2	unfixed	CVE-2026-96662	Oct 10, 2026
HIGH CVSS 8.8	Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter CVE.org	<=5.7.3	unfixed	CVE-2026-104766	Oct 10, 2026
MEDIUM CVSS 4.3	Appointment Booking Plugin <= 5.7.3 - Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion CVE.org	<=5.7.3	unfixed	CVE-2026-103380	Oct 14, 2026
MEDIUM CVSS 4.3	Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter CVE.org	<=5.7.2	unfixed	CVE-2026-91050	Oct 10, 2026
MEDIUM CVSS 5.4	Appointment Booking Plugin – LatePoint \| Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification CVE.org	<=5.6.9	unfixed	CVE-2026-17538	Oct 8, 2026
MEDIUM CVSS 5.3	Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter CVE.org	<=5.7.1	unfixed	CVE-2026-94432	Oct 2, 2026
MEDIUM CVSS 4.3	LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking) CVE.org	<=5.6.3	unfixed	CVE-2026-13471	Sep 18, 2026
MEDIUM CVSS 4.3	LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter CVE.org	<=5.6.9	unfixed	CVE-2026-18441	Sep 18, 2026
MEDIUM CVSS 6.4	LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE.org	<=5.3.2	unfixed	CVE-2026-5391	Aug 6, 2026
LOW CVSS 3.7	Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter CVE.org	<=5.7.4	unfixed	CVE-2026-111602	Oct 17, 2026

Data aggregated from WPVulnerability, NVD/NIST, ENISA EUVD, CVE.org and WordPress.org. Provided as-is; verify with the plugin author before acting. Disclaimer.