Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress Security & Risk Analysis

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.3 - Unauthenticated SQL Injection

LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount-Binding Bypass

LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step

LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via 'service_id' Parameter

LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via 'order[customer_id]' Parameter

LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OsOrdersController::create_or_update + Unauthenticated Customer-Cabinet Password Reset

LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices__change_status Action

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation

LatePoint <= 5.3.2 - Cross-Site Request Forgery via 'customer_cabinet__request_cancellation' AJAX Route

LatePoint <= 5.5.0 - Unauthenticated Account Takeover via Weak Password Recovery Mechanism

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting

LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter

LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update

LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability

LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID

LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting

LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import

LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure

LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting

LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function

LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function

LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting

LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion

Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference

LatePoint <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting

LatePoint <= 5.0.12 - Authentication Bypass

LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection

LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting

LatePoint <= 4.9.91 - Cross-Site Request Forgery

LatePoint Plugin <= 4.9.9 - Missing Authorization and Sensitive Information Exposure via IDOR