Advisories · Technology
LatePoint – Calendar Booking Plugin for Appointments and Events.
Every CVE that names LatePoint – Calendar Booking Plugin for Appointments and Events among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 7.5 High
LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Broken access control
- CVSS 5.3 Medium
LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Broken access control
- CVSS 5.3 Medium
LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Broken access control
- CVSS 8.8 High
LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Privilege escalation
- CVSS 7.5 High
LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Privilege escalation
- CVSS 4.3 Medium
LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site request forgery (CSRF)
- CVSS 4.3 Medium
LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism
- LatePoint – Calendar Booking Plugin for Appointments and Events
- CWE-640
- CVSS 7.2 High
LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site scripting (XSS)
- CVSS 8.8 High
LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Privilege escalation
- CVSS 5.3 Medium
LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Broken access control
- CVSS 6.4 Medium
LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site request forgery (CSRF)
- CVSS 6.5 Medium
LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import
- LatePoint – Calendar Booking Plugin for Appointments and Events
- SQL injection
- CVSS 8.8 High
LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Privilege escalation
- CVSS 4.3 Medium
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site request forgery (CSRF)
- CVSS 5.3 Medium
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Broken access control
- CVSS 7.2 High
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site scripting (XSS)
- CVSS 8.8 High
LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site request forgery (CSRF)
- CVSS 8.2 High
LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Authentication bypass
- CVSS 6.4 Medium
LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site scripting (XSS)
- CVSS 5.5 Medium
LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference
- LatePoint – Calendar Booking Plugin for Appointments and Events
- Broken access control