High
CVE-2026-7448
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 49
Reset filters
High
CVE-2026-7332
LatePoint <= 5.5.0 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter
Medium
CVE-2026-7457
LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update
High
CVE-2026-6741
LatePoint <= 5.4.1 - Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability
Medium
CVE-2026-5234
LatePoint <= 5.3.2 - Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID
Medium
CVE-2026-4785
LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2026-32533
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Authenticated (Subscriber+) Insecure Direct Object Reference
Medium
CVE-2026-2324
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting
Medium
CVE-2026-1487
LatePoint <= 5.2.7 - Authenticated (Administrator+) SQL Injection via JSON Import
High
CVE-2026-1566
LatePoint <= 5.2.7 - Authenticated (Agent+) Privilege Escalation
Medium
CVE-2025-14873
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Cross-Site Request Forgery
Medium
CVE-2026-1537
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.6 - Missing Authorization to Booking Details Exposure
High
CVE-2026-0617
LatePoint – Calendar Booking Plugin for Appointments and Events <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting
High
CVE-2025-7052
LatePoint <= 5.1.94 - Cross-Site Request Forgery to Account Takeover via change_password() Function
High
CVE-2025-7038
LatePoint <= 5.1.94 - Unauthenticated Authentication Bypass via load_step Function
Medium
CVE-2025-6941
LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
Medium
CVE-2025-6815
LatePoint <= 5.1.94 - Authenticated (Administrator+) Stored Cross-Site Scripting
Critical
CVE-2025-6715
LatePoint <= 5.1.93 - Unauthenticated Local File Inclusion
Medium
CVE-2025-3769
Latepoint <= 5.1.92 - Unauthenticated Insecure Direct Object Reference
Medium
CVE-2025-30836
LatePoint <= 5.1.6 - Authenticated (Contributor+) Stored Cross-Site Scripting
Critical
CVE-2024-8943
LatePoint <= 5.0.12 - Authentication Bypass
Critical
CVE-2024-8911
LatePoint <= 5.0.11 - Unauthenticated Arbitrary User Password Change via SQL Injection
Medium
CVE-2024-43992
LatePoint <= 4.9.91 - Authenticated (Subscriber+) Stored Cross-Site Scripting
Medium
CVE-2024-43945
LatePoint <= 4.9.91 - Cross-Site Request Forgery
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.