CVE-2026-9055

CVE-2026-9055 — Amelia Booking Plugin Unauthenticated Privilege Escalation Research writeup by Sentinel AI Defense. Defensive analysis only — no working exploit or PoC is published here for this vulnerability. An unauthenticated privilege escalation vulnerability in the Amelia Premium WordPress...

CVE-2026-118066

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the OsModel::buildconditionsquery function in lib/models/model.php comparin...

CVE-2026-118066 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Authentication Bypass via Account Takeover via 'IS NOT NULL' Sentinel in 'password_reset_token' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the OsModel::buildconditionsquery function in lib/models/model.php comparin...

CVE-2026-118066

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to an Authentication Bypass via Account Takeover in all versions up to and including 5.7.6 . The root cause lies in the OsModel::build_conditions_query() function in lib/models/mode...

CVE-2026-119152

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customeremail inside params' parameter in all versions up to, and including, 5.7.6 due to insufficient input sanitization and output escaping...

CVE-2026-119152 Appointment Booking Plugin <= 5.7.6 - Unauthenticated Stored Cross-Site Scripting via Customer Email Field

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customeremail inside params' parameter in all versions up to, and including, 5.7.6 due to insufficient input sanitization and output escaping...

CVE-2026-119152

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin (versions ≤ 5.7.6 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The root cause is insufficient input sanitization and output escaping of the customer[email] parameter. An unauthenticated attacker can ...

EUVD-2026-118563

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'customeremail inside params' parameter in all versions up to, and including, 5.7.6 due to insufficient input sanitization and output escaping...

VulnCheck KEV: CVE-2026-118066

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the OsModel::buildconditionsquery function in lib/models/model.php comparin...

PT-2026-134915

Name of the Vulnerable Software and Affected Versions BookIt versions prior to 2.6.0.6 Description An SQL Injection issue exists in the booking plugin, where improper neutralization of special elements used in an SQL command allows an attacker to inject malicious database commands. This could...

CVE-2026-105258

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...

EUVD-2026-112617

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...

PT-2026-130635

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...

CVE-2026-105258: Unknown Appointment Booking Plugin: The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings…

The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads...

VulnCheck KEV: CVE-2026-96662

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'bookingserviceid' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the user supplied parameter and lack of...

CVE-2026-105257

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site,...

EUVD-2026-107051

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site,...

PT-2026-120446

The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site,...

CVE-2026-111602

The LatePoint | Calendar & Scheduling WordPress plugin is vulnerable to Sensitive Information Exposure in versions up to and including 5.7.4 . The root cause is an ORM Operator Injection occurring via the params (customer[uuid]) parameter. This allows unauthenticated attackers to extract sensitiv...

CVE-2026-111602 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Sensitive Information Disclosure via ORM Operator Injection in 'customer[uuid]' Parameter

The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 5.7.4 via the 'params customeruuid' parameter. This makes it possible for unauthenticated attackers to extrac...