WordPress Vulnerability Scanner WPSec
Vulnerabilities / Appointment Booking Plugin

Appointment Booking Plugin vulnerabilities

Advisories WPSec published for Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress. Other sources may list more. Its attack surface: Appointment Booking Plugin on WPSec AttackSurface.

PublishedIDVulnerabilitySeverityFixed in
2026-10-17 WPSEC-2026-1166 Appointment Booking Plugin <= 5.7.4 - Unauthenticated OTP Brute Force via Race Condition in OTP Verification Medium 4.8 5.7.5
2026-10-17 WPSEC-2026-1165 Appointment Booking Plugin <= 5.7.4 - Authenticated (LatePoint Agent+) Insecure Direct Object Reference to Customer Information Disclosure Medium 4.3 5.7.5
2026-10-17 WPSEC-2026-1164 Appointment Booking Plugin <= 5.7.4 - Unauthenticated Payment Bypass via 'payment_portion' Parameter Medium 5.3 5.7.5
2026-10-06 WPSEC-2026-0452 Appointment Booking Plugin <= 5.7.3 - Unauthenticated Sensitive Information Exposure via Template Variable Injection in Customer Name and Notes Medium 5.3 5.7.4
2026-10-06 WPSEC-2026-0451 Appointment Booking Plugin <= 5.7.3 - Unauthenticated Insecure Direct Object Reference to Cart Item Modification via 'active_cart_item[id]' Medium 5.3 5.7.4
2026-10-02 WPSEC-2026-0286 LatePoint <= 5.7.2 - Unauthenticated Insecure Direct Object Reference to Payment Bypass and Customer Information Disclosure via 'order_item_id' Parameter Medium 6.5 5.7.3
2026-10-02 WPSEC-2026-0285 LatePoint <= 5.7.2 - Unauthenticated Account Takeover of Subscriber-Level Users via Customer Email to Username Matching Medium 4.8 5.7.3
2026-10-02 WPSEC-2026-0284 LatePoint <= 5.7.2 - Unauthenticated SQL Injection via Booking Parameters High 7.5 5.7.3

License: CC BY 4.0