agentprime: latepoint-calendar-booking-plugin-for-appointments-and-eventsEvery new CVE for latepoint-calendar-booking-plugin-for-appointments-and-events.https://agentprime.io/CVE-2026-5356: LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypasshttps://agentprime.io/advisories/CVE-2026-5356/https://agentprime.io/advisories/CVE-2026-5356/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Jul 2026 12:33:15 GMTCVECVE-2026-11398: LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Stephttps://agentprime.io/advisories/CVE-2026-11398/https://agentprime.io/advisories/CVE-2026-11398/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 03 Jul 2026 07:53:10 GMTCVECVE-2026-12657: LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameterhttps://agentprime.io/advisories/CVE-2026-12657/https://agentprime.io/advisories/CVE-2026-12657/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 02 Jul 2026 08:33:04 GMTCVECVE-2026-13228: LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameterhttps://agentprime.io/advisories/CVE-2026-13228/https://agentprime.io/advisories/CVE-2026-13228/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 01 Jul 2026 09:32:28 GMTCVECVE-2026-8176: LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Resethttps://agentprime.io/advisories/CVE-2026-8176/https://agentprime.io/advisories/CVE-2026-8176/CVSS 7.5 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 16 Jun 2026 09:31:33 GMTCVECVE-2026-9719: LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Actionhttps://agentprime.io/advisories/CVE-2026-9719/https://agentprime.io/advisories/CVE-2026-9719/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 05 Jun 2026 23:28:27 GMTCVECVE-2026-5365: LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Routehttps://agentprime.io/advisories/CVE-2026-5365/https://agentprime.io/advisories/CVE-2026-5365/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 14 May 2026 06:44:11 GMTCVECVE-2026-7652: LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanismhttps://agentprime.io/advisories/CVE-2026-7652/https://agentprime.io/advisories/CVE-2026-7652/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 09 May 2026 02:25:39 GMTCVECVE-2026-7332: LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameterhttps://agentprime.io/advisories/CVE-2026-7332/https://agentprime.io/advisories/CVE-2026-7332/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Wed, 06 May 2026 06:47:21 GMTCVECVE-2026-7457: LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Updatehttps://agentprime.io/advisories/CVE-2026-7457/https://agentprime.io/advisories/CVE-2026-7457/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 06 May 2026 06:47:21 GMTCVECVE-2026-6741: LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Abilityhttps://agentprime.io/advisories/CVE-2026-6741/https://agentprime.io/advisories/CVE-2026-6741/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 27 Apr 2026 19:36:46 GMTCVECVE-2026-5234: LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice IDhttps://agentprime.io/advisories/CVE-2026-5234/https://agentprime.io/advisories/CVE-2026-5234/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Fri, 17 Apr 2026 03:36:44 GMTCVECVE-2026-4785: LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodehttps://agentprime.io/advisories/CVE-2026-4785/https://agentprime.io/advisories/CVE-2026-4785/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 08 Apr 2026 03:36:09 GMTCVECVE-2026-2324: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scriptinghttps://agentprime.io/advisories/CVE-2026-2324/https://agentprime.io/advisories/CVE-2026-2324/CVSS 6.1 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 11 Mar 2026 01:22:04 GMTCVECVE-2026-1487: LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Importhttps://agentprime.io/advisories/CVE-2026-1487/https://agentprime.io/advisories/CVE-2026-1487/CVSS 6.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Mar 2026 01:21:51 GMTCVECVE-2026-1566: LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalationhttps://agentprime.io/advisories/CVE-2026-1566/https://agentprime.io/advisories/CVE-2026-1566/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Mon, 02 Mar 2026 23:22:55 GMTCVECVE-2025-14873: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgeryhttps://agentprime.io/advisories/CVE-2025-14873/https://agentprime.io/advisories/CVE-2025-14873/CVSS 4.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Sat, 14 Feb 2026 06:42:26 GMTCVECVE-2026-1537: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposurehttps://agentprime.io/advisories/CVE-2026-1537/https://agentprime.io/advisories/CVE-2026-1537/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Thu, 12 Feb 2026 02:23:25 GMTCVECVE-2026-0617: LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scriptinghttps://agentprime.io/advisories/CVE-2026-0617/https://agentprime.io/advisories/CVE-2026-0617/CVSS 7.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 03 Feb 2026 06:38:02 GMTCVECVE-2025-7052: LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Functionhttps://agentprime.io/advisories/CVE-2025-7052/https://agentprime.io/advisories/CVE-2025-7052/CVSS 8.8 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Sep 2025 04:27:07 GMTCVECVE-2025-7038: LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Functionhttps://agentprime.io/advisories/CVE-2025-7038/https://agentprime.io/advisories/CVE-2025-7038/CVSS 8.2 (High). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Sep 2025 04:27:07 GMTCVECVE-2025-6941: LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcodehttps://agentprime.io/advisories/CVE-2025-6941/https://agentprime.io/advisories/CVE-2025-6941/CVSS 6.4 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Sep 2025 04:27:07 GMTCVECVE-2025-6815: LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scriptinghttps://agentprime.io/advisories/CVE-2025-6815/https://agentprime.io/advisories/CVE-2025-6815/CVSS 5.5 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Tue, 30 Sep 2025 04:27:06 GMTCVECVE-2025-3769: Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Referencehttps://agentprime.io/advisories/CVE-2025-3769/https://agentprime.io/advisories/CVE-2025-3769/CVSS 5.3 (Medium). Published by the CVE Program. Not analysed by agentprime yet.Wed, 14 May 2025 11:12:25 GMTCVE