LatePoint <= 5.0.12 - Authentication Bypass

LatePoint plugin for WordPress versions up to 5.0.12 contains an authentication bypass caused by insufficient verification of user during booking, letting unauthenticated attackers log in as any existing user if they have user ID access, exploit requires access to user ID, and the 'Use WordPress...

LatePoint < 5.7.7 - Unauthenticated Authentication Bypass / Account Takeover

Unauthenticated SQL operator injection in the latepointroutecall AJAX route wpajaxnopriv. buildconditionsquery in lib/models/model.php treats literal 'IS NULL'/'IS NOT NULL' as SQL operators and concatenates them unbound, bypassing the customer password-reset token check - account takeover of...

LatePoint <= 5.0.11 - SQL Injection

The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible f...

CVE-2026-49083

CVE-2026-49083 CVE-2026-49083 LatePoint Calendar Booking Plugin Privilege Escalation Exploit 🎲🎲🎲...

CVE-2026-49083

CVE-2026-49083 CVE-2026-49083 LatePoint Calendar Booking Plugin Privilege Escalation Exploit...

CVE-2026-92966

CVE-2026-92966 — LatePoint ≤ 5.7.0 unauthenticated stored shortcode execution Field| Value ---|--- CVE| CVE-2026-92966 Product| LatePoint — Appointment Booking Affected| ≤ 5.7.0 Fixed| 5.7.1 CWE| CWE-94 — Code injection shortcode execution CVSS 3.1| 9.1 Critical AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:...

CVE-2026-118066

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the OsModel::buildconditionsquery function in lib/models/model.php comparin...

EUVD-2026-119141

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the OsModel::buildconditionsquery function in lib/models/model.php comparin...

CVE-2026-6741

CVE-2026-6741 CVE-2026-6741 is a CVSS 8.8 High Authenticated Agent+ Privilege Escalation vulnerability in the LatePoint – Calendar Booking Plugin CVE-2026-6741 — LatePoint Privilege Escalation Scanner Plugin: LatePoint – Calendar Booking Plugin for Appointments and Events latepoint CVE ID:...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.6 - Unauthenticated Authentication Bypass vulnerability

Unauthenticated Authentication Bypass vulnerability discovered by Jakub Herman in WordPress Plugin LatePoint versions = 5.7.6...

CVE-2026-119152

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customeremail inside params' parameter in all versions up to, and including, 5.7.6 due to insufficient input sanitization and output escaping...

EUVD-2026-118563

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customeremail inside params' parameter in all versions up to, and including, 5.7.6 due to insufficient input sanitization and output escaping...

PT-2026-139434

Name of the Vulnerable Software and Affected Versions LatePoint | Calendar & Scheduling for WordPress versions prior to 5.7.7 Description An authentication bypass allows unauthenticated attackers to take over customer accounts. The issue exists in the OsModel::build conditions query function with...

VulnCheck KEV: CVE-2026-118066

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the OsModel::buildconditionsquery function in lib/models/model.php comparin...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability discovered by Maciej Komorowski in WordPress Plugin LatePoint versions = 5.7.6...

CVE-2026-105258

The LatePoint (Appointment Booking Plugin) for WordPress is vulnerable to a Stored Cross-Site Scripting (XSS) flaw in versions prior to 5.7.6 . The root cause is a failure to escape several booking-form step content settings before they are rendered on the public booking form. This allows high-pr...

CVE-2026-105258 LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...

WordPress Appointment Booking Plugin plugin < 5.7.6 - Admin+ Stored XSS vulnerability

Admin+ Stored XSS vulnerability discovered by Karthik Ramakrishnan in WordPress Plugin LatePoint versions 5.7.6...

CVE-2026-105258 LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...

VulnCheck KEV: CVE-2026-96662

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...