Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress vulnerabilities
7 known vulnerabilities in Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress from LatePoint. 7 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.1 Critical severity
Appointment Booking Plugin – LatePoint |…: Improper Authentication
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Account Takeover in all versions up to, and including, 5.7.6. This is due to the `OsModel::build_conditions_query()
- 9.1 Critical severity
Appointment Booking Plugin – LatePoint |…: Improper Authentication
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass via Race Condition in all versions up to, and including, 5.7.4. This is due to a non-atomic read-modify-write on the OT
- 7.5 High severity
Appointment Booking Plugin – LatePoint |…: Authorization Bypass Through User-Controlled Key
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 5.7.3 via the `booking[id]` and `cart[id]` parameters on the `steps__reloa
- 7.4 High severity
Appointment Booking Plugin – LatePoint |…: Improper Authentication
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 5.7.2 via the OsCustomerHelper::create_wp_user_for_customer() helper reached from the
- 7.5 High severity
Appointment Booking Plugin – LatePoint |…: Improper Neutralization of Special Elements used in an SQL Command
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to generic SQL Injection via 'booking[service_id]' Parameter in all versions up to, and including, 5.7.2 due to insufficient escaping on the use
- 8.8 High severity
Appointment Booking Plugin – LatePoint |…: Improper Privilege Management
The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.7.3. This is due to the `OsSettingsController::update()` handler iterating over
- 9.1 Critical severity
Appointment Booking Plugin – LatePoint |…: Improper Control of Generation of Code
The The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.7.0. This is due to the software allowing users to execute an actio