# LatePoint vulnerabilities Source: https://junglewise.ai/threats/vendors/latepoint Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 10 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/latepoint.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 26 vulnerabilities in LatePoint: 2 in the last 7 days and 13 in the last 90 days, 4 of them critical and 0 exploited in the wild. The most recent, CVE-2026-118066, was published on 7 November 2026. 6 vulnerabilities in the last four weeks, down 14% on the four before (7). 2 critical against 1. 1 technology has a page of its own. ## Counts - Last 7 days: 2 - Last 30 days: 6 - Last 90 days: 13 - All time: 26 (4 critical, 0 exploited in the wild) ## About LatePoint A software company that develops appointment booking and scheduling systems for WordPress. ## Latest LatePoint vulnerabilities - [CVE-2026-118066: LatePoint authentication bypass via SQL injection in password reset](https://junglewise.ai/threats/cve-2026-118066-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (critical, CVSS 9.1, published 7 Nov 2026) - [CVE-2026-119152: LatePoint stored cross-site scripting in customer email parameter](https://junglewise.ai/threats/cve-2026-119152-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (medium, CVSS 5.4, published 7 Nov 2026) - [CVE-2026-105258: LatePoint WordPress plugin stored XSS in booking form settings](https://junglewise.ai/threats/cve-2026-105258-the-appointment-booking-plugin-wordpress-plugin-before-5-7-6) (info, published 29 Oct 2026) - [CVE-2026-105256: LatePoint WordPress plugin payment bypass in booking checkout](https://junglewise.ai/threats/cve-2026-105256-the-latepoint-wordpress-plugin-before-5-7-5-does-not-validate) (medium, CVSS 5.3, published 21 Oct 2026) - [CVE-2026-105257: LatePoint WordPress plugin IDOR in customer data access](https://junglewise.ai/threats/cve-2026-105257-the-appointment-booking-plugin-wordpress-plugin-before-5-7-5) (info, published 21 Oct 2026) - [CVE-2026-110653: LatePoint WordPress plugin authentication bypass via race condition](https://junglewise.ai/threats/cve-2026-110653-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (critical, CVSS 9.1, published 17 Oct 2026) - [CVE-2026-96662: LatePoint appointment booking plugin SQL injection](https://junglewise.ai/threats/cve-2026-96662-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (high, CVSS 7.5, published 10 Oct 2026) - [CVE-2026-91050: LatePoint appointment booking plugin insecure direct object reference](https://junglewise.ai/threats/cve-2026-91050-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (medium, CVSS 4.3, published 10 Oct 2026) - [CVE-2026-104766: LatePoint privilege escalation via settings update](https://junglewise.ai/threats/cve-2026-104766-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (high, CVSS 8.8, published 10 Oct 2026) - [CVE-2026-94432: LatePoint insecure direct object reference in order creation](https://junglewise.ai/threats/cve-2026-94432-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (medium, CVSS 5.3, published 2 Oct 2026) - [CVE-2026-92966: LatePoint arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-92966-the-the-appointment-booking-plugin-latepoint-calendar-scheduling) (critical, CVSS 9.1, published 1 Oct 2026) - [CVE-2026-13471: LatePoint Calendar Booking insecure direct object reference](https://junglewise.ai/threats/cve-2026-13471-latepoint-calendar-booking-insecure-direct-object-reference) (medium, CVSS 4.3, published 18 Sep 2026) - [CVE-2026-18441: LatePoint insecure direct object reference in customer enumeration](https://junglewise.ai/threats/cve-2026-18441-latepoint-insecure-direct-object-reference-in-customer) (medium, CVSS 4.3, published 18 Sep 2026) - [CVE-2026-15250: LatePoint Appointment Booking mass assignment in booking funnel](https://junglewise.ai/threats/cve-2026-15250-latepoint-appointment-booking-mass-assignment-in-booking-funnel) (info, CVSS 5.3, published 30 Jul 2026) - [CVE-2026-11866: LatePoint Appointment Booking Plugin CSRF in central request dispatcher](https://junglewise.ai/threats/cve-2026-11866-latepoint-appointment-booking-plugin-csrf-in-central-request) (info, CVSS 5.4, published 16 Jul 2026) - [CVE-2026-57714: LatePoint SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-57714-latepoint-sql-injection-in-wordpress-plugin) (critical, CVSS 9.3, published 13 Jul 2026) - [CVE-2026-5356: LatePoint Calendar Booking Plugin improper input validation in Stripe Connect](https://junglewise.ai/threats/cve-2026-5356-latepoint-calendar-booking-plugin-improper-input-validation-in) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-11398: LatePoint Calendar Booking Plugin authorization bypass in process_step_customer](https://junglewise.ai/threats/cve-2026-11398-latepoint-calendar-booking-plugin-authorization-bypass-in-process) (medium, CVSS 5.3, published 3 Jul 2026) - [CVE-2026-12657: LatePoint WordPress Plugin IDOR in service_id parameter](https://junglewise.ai/threats/cve-2026-12657-latepoint-wordpress-plugin-idor-in-service-id-parameter) (medium, CVSS 5.3, published 2 Jul 2026) - [CVE-2026-13228: LatePoint Calendar Booking Plugin privilege escalation in OsOrdersController](https://junglewise.ai/threats/cve-2026-13228-latepoint-calendar-booking-plugin-privilege-escalation-in) (high, CVSS 8.8, published 1 Jul 2026) - [CVE-2026-8176: LatePoint Calendar Booking privilege escalation to Administrator](https://junglewise.ai/threats/cve-2026-8176-latepoint-calendar-booking-privilege-escalation-to-administrator) (high, CVSS 7.5, published 16 Jun 2026) - [CVE-2026-49083: LatePoint WordPress plugin privilege escalation in Contributor accounts](https://junglewise.ai/threats/cve-2026-49083-latepoint-wordpress-plugin-privilege-escalation-in-contributor) (high, CVSS 7.5, published 15 Jun 2026) - [CVE-2026-9719: LatePoint WordPress Plugin CSRF in change_status function](https://junglewise.ai/threats/cve-2026-9719-latepoint-wordpress-plugin-csrf-in-change-status-function) (medium, CVSS 4.3, published 6 Jun 2026) - [CVE-2026-5365: LatePoint WordPress plugin CSRF in request_cancellation](https://junglewise.ai/threats/cve-2026-5365-latepoint-wordpress-plugin-csrf-in-request-cancellation) (medium, CVSS 4.3, published 14 May 2026) - [CVE-2026-7652: LatePoint WordPress plugin account takeover via weak password recovery mechanism](https://junglewise.ai/threats/cve-2026-7652-latepoint-wordpress-plugin-account-takeover-via-weak-password) (medium, CVSS 5.3, published 9 May 2026) ## Most severe LatePoint vulnerabilities - [CVE-2026-57714: LatePoint SQL injection in WordPress plugin](https://junglewise.ai/threats/cve-2026-57714-latepoint-sql-injection-in-wordpress-plugin) (critical, CVSS 9.3, published 13 Jul 2026) - [CVE-2026-92966: LatePoint arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-92966-the-the-appointment-booking-plugin-latepoint-calendar-scheduling) (critical, CVSS 9.1, published 1 Oct 2026) - [CVE-2026-118066: LatePoint authentication bypass via SQL injection in password reset](https://junglewise.ai/threats/cve-2026-118066-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (critical, CVSS 9.1, published 7 Nov 2026) - [CVE-2026-110653: LatePoint WordPress plugin authentication bypass via race condition](https://junglewise.ai/threats/cve-2026-110653-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (critical, CVSS 9.1, published 17 Oct 2026) - [CVE-2026-104766: LatePoint privilege escalation via settings update](https://junglewise.ai/threats/cve-2026-104766-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (high, CVSS 8.8, published 10 Oct 2026) - [CVE-2026-13228: LatePoint Calendar Booking Plugin privilege escalation in OsOrdersController](https://junglewise.ai/threats/cve-2026-13228-latepoint-calendar-booking-plugin-privilege-escalation-in) (high, CVSS 8.8, published 1 Jul 2026) - [CVE-2026-96662: LatePoint appointment booking plugin SQL injection](https://junglewise.ai/threats/cve-2026-96662-the-appointment-booking-plugin-latepoint-calendar-scheduling-for) (high, CVSS 7.5, published 10 Oct 2026) - [CVE-2026-5356: LatePoint Calendar Booking Plugin improper input validation in Stripe Connect](https://junglewise.ai/threats/cve-2026-5356-latepoint-calendar-booking-plugin-improper-input-validation-in) (high, CVSS 7.5, published 8 Jul 2026) - [CVE-2026-8176: LatePoint Calendar Booking privilege escalation to Administrator](https://junglewise.ai/threats/cve-2026-8176-latepoint-calendar-booking-privilege-escalation-to-administrator) (high, CVSS 7.5, published 16 Jun 2026) - [CVE-2026-49083: LatePoint WordPress plugin privilege escalation in Contributor accounts](https://junglewise.ai/threats/cve-2026-49083-latepoint-wordpress-plugin-privilege-escalation-in-contributor) (high, CVSS 7.5, published 15 Jun 2026) ## Vulnerabilities per week 6 vulnerabilities in the last four weeks, down 14% on the four before (7). 2 critical against 1. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 2 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 2 | 1 | 0 | | 5 Oct 2026 | 3 | 0 | 0 | | 12 Oct 2026 | 1 | 1 | 0 | | 19 Oct 2026 | 2 | 0 | 0 | | 26 Oct 2026 | 1 | 0 | 0 | | 2 Nov 2026 | 2 | 1 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## LatePoint technologies - [LatePoint](https://junglewise.ai/threats/technologies/latepoint): 25 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "LatePoint vulnerabilities", https://junglewise.ai/threats/vendors/latepoint, 10 November 2026.