Vendor security profile

latepoint

Product portfolio, patch evidence and exploitation signals in a single security scorecard

The data is combined from the CVE Program, NVD, CISA KEV and vendor security advisories.Scope: all CVE records matched to the company · Source evidence is on each CVE's page

Total CVEs9

Critical1

CISA KEV0

Public exploit0

Patch rate%0

Avg. CVSS6.2

12-month vulnerability rate

CVEs published, and the CISA KEV records among them

Kas

Ara

Oca

Şub

Mar

Nis

May

Haz

Tem

Ağu

Eyl

Eki

CVE KEV

CVE severity distribution

The company's whole portfolio of recorded CVEs

9toplam CVE

Critical1 (11%)

High2 (22%)

Medium6 (67%)

Patch and exploitation view

Patch evidence, public exploits and active exploitation signals together

Verified patch

0 records

CISA KEV

0 records

Public exploit

0 records

0Patch available

0Partial

0Workaround

0Vendor: no patch

9Unknown

Latest vulnerabilities

The 10 newest records · metrics are calculated over the whole period

View all

7.5

CVE-2026-96662

Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter

VendorlatepointProductAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Patch status unknownEPSS %01 d ago

8.8

CVE-2026-104766

Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter

VendorlatepointProductAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Patch status unknownEPSS %01 d ago

4.3

CVE-2026-91050

Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter

VendorlatepointProductAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Patch status unknownEPSS %01 d ago

5.4

CVE-2026-17538

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

VendorlatepointProductAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Patch status unknownEPSS %04 d ago

5.3

CVE-2026-94432

Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter

VendorlatepointProductAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Patch status unknownEPSS %09 d ago

9.1

CVE-2026-92966

Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

VendorlatepointProductAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Patch status unknownEPSS %010 d ago

4.3

CVE-2026-13471

LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)

VendorlatepointProductAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Patch status unknownEPSS %023 d ago

4.3

CVE-2026-18441

LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

VendorlatepointProductAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Patch status unknownEPSS %024 d ago

6.4

CVE-2026-5391

LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

VendorlatepointProductAppointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress

Patch status unknownEPSS %02 mo ago

latepoint

12-month vulnerability rate

CVE severity distribution

Patch and exploitation view

Latest vulnerabilities

Appointment Booking Plugin <= 5.7.2 - Unauthenticated SQL Injection via 'booking[service_id]' Parameter

Appointment Booking Plugin <= 5.7.3 - Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter

Appointment Booking Plugin <= 5.7.2 - Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure via 'params[presets][order_item_id]' Parameter

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress <= 5.6.9 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification

Appointment Booking Plugin <= 5.7.1 - Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration via 'invoice_id' Parameter

Appointment Booking Plugin <= 5.7.0 - Unauthenticated Arbitrary Shortcode Execution via First/Last Name Field

LatePoint <= 5.6.3 - Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure via Abilities REST API (list-bookings, list-customers, delete-booking)

LatePoint - Appointment Booking & Scheduling <= 5.6.9 - Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure via 'customer[id]' Parameter

LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes

DayBreach

Glossary & Reference

Directories & Feeds

RSS & Integration