CVE-2026-103366

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

EUVD-2026-100901

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the bookingid and cartid parameters on the stepsreloadbookingformsummarypanel and stepsstart public...

CVE-2026-13612

The KiviCare WordPress plugin before 4.5.2 does not verify that the requesting user owns the records being accessed, allowing authenticated patient-level users to read other patients' bills, invoices and appointment details...

CVE-2026-14221

The Easy Appointments WordPress plugin through 4.0 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and to...

PT-2026-66380

The Easy Appointments WordPress plugin through 3.12.26 does not perform capability checks in several of its appointment-management actions, relying only on a nonce that any authenticated user can obtain, allowing users with contributor-level access to read all customers' appointment details and t...

CVE-2026-4807

CVE-2026-4807 affects the WordPress plugin “Appointment Booking Calendar” (publicly exposed at WordPress.org) up to version 1.6.10.6. The root cause is missing authorization caused by flawed logic in nonce_permissions_check() combined with a site-wide public nonce exposed via /wp-json/ssa/v1/embe...

PT-2025-21146 · WordPress · Latepoint – Calendar Booking Plugin For Appointments/Events

Name of the Vulnerable Software and Affected Versions: LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress versions up to, and including, 5.1.92 Description: The issue allows unauthenticated attackers to retrieve appointment details, such as customer names and ema...

CVE-2024-51066

An Insecure Direct Object Reference IDOR vulnerability in appointment-detail.php in Phpgurukul's Beauty Parlour Management System v1.1 allows unauthorized access to the Personally Identifiable Information PII of other customers...

PT-2023-17829

Name of the Vulnerable Software and Affected Versions alextselegidis/easyappointments versions prior to 1.5.0 Description The issue is related to improper access control, allowing one provider to view and edit other providers' appointment details. A patch is available and is anticipated to be par...

Improper Access Control which allows one provider to view and edit others provider appointment's details

Description Login using one provider's credential. After login successfully, notice there is POST request to /index.php/backendapi/ajaxgetcalendarappointments which allows the provider to view their own appointments information. However, by changing the recordid parameter to any number start from...

Daybyday CRM authorization issue vulnerability

DayByDay CRM is an open source CRM Customer Relationship Management software, based on Laravel, that helps users keep track of clients, tasks, meetings and more. DayByDay CRM Information Disclosure Vulnerability, the vulnerability stems from the product's failure to add an effective restriction o...