Vulnerability archive

Understand vulnerabilities. Protect your applications.

Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.

Platform

Severity

Disclosed from

Disclosed to

Vulnerability archive 49

Reset filters

High 09.10.2026

CVE-2026-96662

Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter

The LatePoint plugin for WordPress is vulnerable to unauthenticated SQL injection via the 'booking[service_id]' parameter in versions up to 5.7.2. Attackers can exploit this flaw to extract sensitive data from the database.

High 09.10.2026

CVE-2026-104766

Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter

Medium 09.10.2026

CVE-2026-91050

Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter

Medium 08.10.2026

CVE-2026-105198

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.7.3 - Unauthenticated Insecure Direct Object Reference

Medium 08.10.2026

CVE-2026-105196

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.9 - Authenticated (Custom Role+) Insecure Direct Object Reference

Medium 08.10.2026

CVE-2026-105197

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress < 5.6.5 - Authenticated (Custom Role+) Insecure Direct Object Reference

Medium 07.10.2026

CVE-2026-17538

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

Medium 01.10.2026

CVE-2026-94432

Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter

Critical 30.09.2026

CVE-2026-92966

Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

Medium 17.09.2026

CVE-2026-13471

LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)

Medium 17.09.2026

CVE-2026-18441

LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

Medium 05.08.2026

CVE-2026-5391

LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

Medium 10.07.2026

CVE-2026-15250

LatePoint <= 5.6.7 - Missing Authorization to Unauthenticated Booking Object Mass Assignment

High 08.07.2026

CVE-2026-57714

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection

High 07.07.2026

CVE-2026-5356

LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass

Medium 02.07.2026

CVE-2026-11398

LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step

Medium 01.07.2026

CVE-2026-12657

LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter

High 30.06.2026

CVE-2026-13228

LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter

Medium 25.06.2026

CVE-2026-11866

LatePoint <= 5.6.2 - Cross-Site Request Forgery

High 15.06.2026

CVE-2026-8176

LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset

Medium 05.06.2026

CVE-2026-9719

LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action

High 05.06.2026

CVE-2026-49083

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation

Medium 13.05.2026

CVE-2026-5365

LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route

Medium 08.05.2026

CVE-2026-7652

LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism

Showing 1 to 24 of 49 results

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application

Understand vulnerabilities. Protect your applications.

Vulnerability archive 49

Know which vulnerabilities affect your application

Application security in your inbox