CVE-2026-18441: Authorization Bypass Through User-Controlled Key

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2026-13471: Authorization Bypass Through User-Controlled Key

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.3 via the LatePointAbilityDeleteBooking::execute due to missing validation on a user controlled key. This makes it...

CVE-2026-18441 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

CVE-2026-18441

The LatePoint – Appointment Booking & Scheduling WordPress plugin (≤ 5.6.9) is vulnerable to an unauthenticated Insecure Direct Object Reference (IDOR) via the customer[id] parameter. The root cause is missing validation on a user-controlled key in the set_customer_object function, allowing attac...

CVE-2026-18441 LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 5.6.9 via the setcustomerobject due to missing validation on a user controlled key. This makes it possible...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure vulnerability

Authenticated Custom+ Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure vulnerability discovered by skyv3il, Chirita Catalin-Andrei CC99IE, AmonRa, MrProperCTF in WordPress Plugin LatePoint versions = 5.6.3...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability

Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability discovered by Sorra in WordPress Plugin LatePoint versions = 5.6.9...

WordPress LatePoint plugin < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel vulnerability

Unauthenticated Booking Object Mass Assignment via Public Booking Funnel vulnerability discovered by Revanth Hari Narayana Matte in WordPress Plugin LatePoint versions 5.6.8...

CVE-2026-5391

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnwrapperclasses' attribute of the 'latepointresources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of...

CVE-2026-5391

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnwrapperclasses' attribute of the 'latepointresources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of...

CVE-2026-5391

CVE-2026-5391 affects the WordPress LatePoint plugin (up to version 5.3.2). The issue is a Stored Cross-Site Scripting flaw in the btn_wrapper_classes attribute of the latepoint_resources shortcode, caused by insufficient input sanitization and output escaping in the locations branch of the short...

CVE-2026-5391 LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnwrapperclasses' attribute of the 'latepointresources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of...

EUVD-2026-53864

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnwrapperclasses' attribute of the 'latepointresources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of...

CVE-2026-5391: Improper Neutralization of Input During Web Page Generation

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btnwrapperclasses' attribute of the 'latepointresources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of...

WordPress Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by alexhenry20 in WordPress Plugin LatePoint versions = 5.3.2...

CVE-2026-15250 LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel

The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's...

CVE-2026-15250 LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel

The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's...

CVE-2026-15250

The LatePoint WordPress plugin (versions prior to 5.6.8 ) is vulnerable to an unauthenticated booking object mass assignment via its public booking funnel. The application fails to restrict which booking fields an unauthenticated visitor can modify, allowing an attacker to assign privileged field...

CVE-2026-11866 LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF

The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the...

CVE-2026-11866 LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF

The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the...