Product by Latepoint

    Latepoint – Calendar Booking Plugin For Appointments And Events

    24 known vulnerabilities in Latepoint – Calendar Booking Plugin For Appointments And Events (Latepoint), 0 of them actively exploited (CISA KEV).

    Key figures

    24

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    0

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Latepoint – Calendar Booking Plugin For Appointments And Events (Latepoint)
    HighCVE-2026-13228

    Improper Privilege Management (CVE-2026-13228)

    		8.8
    HighCVE-2026-8176

    Improper Privilege Management (CVE-2026-8176)

    		7.5
    MediumCVE-2026-12657

    Authorization Bypass Through User-Controlled Key (CVE-2026-12657)

    		5.3
    MediumCVE-2026-7652

    LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism

    		5.3
    HighCVE-2026-7332

    Cross-site Scripting (CVE-2026-7332)

    		7.2
    MediumCVE-2026-5234

    Authorization Bypass Through User-Controlled Key (CVE-2026-5234)

    		5.3
    HighCVE-2026-1566

    LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation

    		8.8
    HighCVE-2026-5356

    Missing Authorization (CVE-2026-5356)

    		7.5
    HighCVE-2026-6741

    Improper Privilege Management (CVE-2026-6741)

    		8.8
    MediumCVE-2026-11398

    Missing Authorization (CVE-2026-11398)

    		5.3
    HighCVE-2025-7038

    LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function

    		8.2
    HighCVE-2026-0617

    Cross-site Scripting (CVE-2026-0617)

    		7.2
    HighCVE-2025-7052

    LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function

    		8.8
    MediumCVE-2026-4785

    LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    		6.4
    MediumCVE-2026-7457

    Cross-site Scripting (CVE-2026-7457)

    		6.4
    MediumCVE-2026-1487

    LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import

    		6.5
    MediumCVE-2025-6941

    LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    		6.4
    MediumCVE-2026-2324

    Cross-Site Request Forgery (CSRF) (CVE-2026-2324)

    		6.1
    MediumCVE-2026-1537

    Missing Authorization (CVE-2026-1537)

    		5.3
    MediumCVE-2025-3769

    Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference

    		5.3
    MediumCVE-2025-6815

    LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting

    		5.5
    MediumCVE-2026-9719

    LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action

    		4.3
    MediumCVE-2026-5365

    Cross-Site Request Forgery (CSRF) (CVE-2026-5365)

    		4.3
    MediumCVE-2025-14873

    Cross-Site Request Forgery (CSRF) (CVE-2025-14873)

    		4.3

    All products by Latepoint