Is Appointment Booking Plugin safe?

Every recorded flaw

• Oct 29, 2026Appointment Booking: Does not escape several booking-form step content settings before rendering them on the public booking formCVE-2026-105258 · fixed in 5.7.6 · reported by WPScan
• Oct 21, 2026LatePoint: Does not validate the client-supplied value that determines how much is charged for a booking against the amounts the service and site actually allowCVE-2026-105256 · fixed in 5.7.5 · reported by WPScanMedium 5.3
• Oct 21, 2026Appointment Booking: Does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's recordCVE-2026-105257 · fixed in 5.7.5 · reported by WPScanLow 2.7
• Oct 16, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Sensitive Information ExposureCVE-2026-111602 · affects up to 5.7.4 · reported by WordfenceLow 3.7
• Oct 16, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Authentication BypassCVE-2026-110653 · affects up to 5.7.4 · reported by WordfenceCritical 9.1
• Oct 14, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Sensitive Information ExposureCVE-2026-103380 · affects up to 5.7.3 · reported by WordfenceMedium 4.3
• Oct 14, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Insecure Direct Object ReferenceCVE-2026-103366 · affects up to 5.7.3 · reported by WordfenceHigh 7.5
• Oct 14, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Authentication BypassCVE-2026-100163 · affects up to 5.7.2 · reported by WordfenceHigh 7.4
• Oct 10, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Generic SQL InjectionCVE-2026-96662 · affects up to 5.7.2 · reported by WordfenceHigh 7.5
• Oct 10, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Insecure Direct Object Reference / Missing AuthorizationCVE-2026-91050 · affects up to 5.7.2 · reported by WordfenceMedium 4.3
• Oct 10, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Privilege EscalationCVE-2026-104766 · affects up to 5.7.3 · reported by WordfenceHigh 8.8
• Oct 8, 2026Appointment Booking: Does not verify that the caller owns the order referenced by an order-item identifier before rendering that order's confirmation summaryCVE-2026-105198 · fixed in 5.7.3 · reported by WPScanMedium 5.3
• Oct 8, 2026Appointment Booking: Does not verify that a backend staff user is authorized to act on the specific record targeted for deletionCVE-2026-105197 · fixed in 5.6.5 · reported by WPScanLow 2.7
• Oct 8, 2026Appointment Booking: Does not enforce per-record authorization on several of its AI Abilities API actionsCVE-2026-105196 · fixed in 5.6.9 · reported by WPScanLow 3.3
• Oct 2, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Insecure Direct Object ReferenceCVE-2026-94432 · affects up to 5.7.1 · reported by WordfenceMedium 5.3
• Oct 1, 2026The Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Arbitrary shortcode executionCVE-2026-92966 · affects up to 5.7.0 · reported by WordfenceCritical 9.1
• Sep 18, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2026-13471 · affects up to 5.6.3 · reported by WordfenceMedium 4.3
• Sep 17, 2026Appointment Booking Plugin – LatePoint | Calendar & Scheduling for: Insecure Direct Object ReferenceCVE-2026-18441 · affects up to 5.6.9 · reported by WordfenceMedium 4.3
• Aug 6, 2026LatePoint: Stored Cross-Site ScriptingCVE-2026-5391 · affects up to 5.3.2 · reported by WordfenceMedium 6.4
• Jul 30, 2026Appointment Booking: Does not restrictCVE-2026-15250 · fixed in 5.6.8 · reported by WPScanMedium 5.3
• Jul 16, 2026Appointment Booking: Does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcherCVE-2026-11866 · fixed in 5.6.3 · reported by WPScanMedium 5.4
• Jul 13, 2026LatePoint: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2026-57714 · affects up to 5.6.3 · reported by PatchstackCritical 9.3
• Jul 8, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Improper Input ValidationCVE-2026-5356 · affects up to 5.4.0 · reported by WordfenceHigh 7.5
• Jul 3, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Authorization bypassCVE-2026-11398 · affects up to 5.6.1 · reported by WordfenceMedium 5.3
• Jul 2, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2026-12657 · affects up to 5.6.2 · reported by WordfenceMedium 5.3
• Jul 1, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege Escalation to AdministratorCVE-2026-13228 · affects up to 5.6.3 · reported by WordfenceHigh 8.8
• Jun 16, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege Escalation to AdministratorCVE-2026-8176 · affects up to 5.5.1 · reported by WordfenceHigh 7.5
• Jun 15, 2026Contributor Privilege Escalation in LatePoint <= 5.5.1 versions.CVE-2026-49083 · affects up to 5.5.1 · reported by PatchstackHigh 7.5
• Jun 5, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Cross-Site Request ForgeryCVE-2026-9719 · affects up to 5.6.0 · reported by WordfenceMedium 4.3
• May 14, 2026LatePoint: Cross-Site Request ForgeryCVE-2026-5365 · affects up to 5.3.2 · reported by WordfenceMedium 4.3
• May 8, 2026LatePoint: Account TakeoverCVE-2026-7652 · affects up to 5.5.0 · reported by WordfenceMedium 5.3
• May 6, 2026LatePoint: Stored Cross-Site ScriptingCVE-2026-7457 · affects up to 5.5.0 · reported by WordfenceMedium 6.4
• May 6, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Stored Cross-Site ScriptingCVE-2026-7332 · affects up to 5.5.0 · reported by WordfenceHigh 7.2
• Apr 27, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege EscalationCVE-2026-6741 · affects up to 5.4.1 · reported by WordfenceHigh 8.8
• Apr 17, 2026LatePoint: Insecure Direct Object ReferenceCVE-2026-5234 · affects up to 5.3.2 · reported by WordfenceMedium 5.3
• Apr 8, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Stored Cross-Site ScriptingCVE-2026-4785 · affects up to 5.3.0 · reported by WordfenceMedium 6.4
• Mar 25, 2026LatePoint: Authorization Bypass Through User-Controlled KeyCVE-2026-32533 · affects up to 5.2.6 · reported by PatchstackMedium 6.5
• Mar 10, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Cross-Site Request ForgeryCVE-2026-2324 · affects up to 5.2.7 · reported by WordfenceMedium 6.1
• Mar 2, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: SQL InjectionCVE-2026-1487 · affects up to 5.2.7 · reported by WordfenceMedium 6.5
• Mar 2, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Privilege escalationCVE-2026-1566 · affects up to 5.2.7 · reported by WordfenceHigh 8.8
• Feb 14, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Cross-Site Request ForgeryCVE-2025-14873 · affects up to 5.2.5 · reported by WordfenceMedium 4.3
• Feb 11, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Unauthorized access of dataCVE-2026-1537 · affects up to 5.2.6 · reported by WordfenceMedium 5.3
• Feb 3, 2026LatePoint – Calendar Booking Plugin for Appointments and Events: Stored Cross-Site ScriptingCVE-2026-0617 · affects up to 5.2.5 · reported by WordfenceHigh 7.2
• Sep 30, 2025LatePoint: Cross-Site Request ForgeryCVE-2025-7052 · affects up to 5.1.94 · reported by WordfenceHigh 8.8
• Sep 30, 2025LatePoint: Authentication BypassCVE-2025-7038 · affects up to 5.1.94 · reported by WordfenceHigh 8.2
• Sep 30, 2025LatePoint – Calendar Booking Plugin for Appointments and Events: Stored Cross-Site ScriptingCVE-2025-6941 · affects up to 5.1.94 · reported by WordfenceMedium 6.4
• Sep 30, 2025LatePoint – Calendar Booking Plugin for Appointments and Events: Stored Cross-Site ScriptingCVE-2025-6815 · affects up to 5.1.94 · reported by WordfenceMedium 5.5
• Aug 13, 2025LatePoint: Is vulnerable to Local File Inclusion via the layout parameterCVE-2025-6715 · fixed in 5.1.94 · reported by WPScanCritical 9.8
• May 14, 2025LatePoint – Calendar Booking Plugin for Appointments and Events: Insecure Direct Object ReferenceCVE-2025-3769 · affects up to 5.1.92 · reported by WordfenceMedium 5.3
• Mar 27, 2025LatePoint: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-30836 · affects up to 5.1.6 · reported by PatchstackMedium 6.5
• Oct 21, 2024LatePoint: Cross-Site Request Forgery (CSRF)CVE-2024-43945 · affects up to 4.9.91 · reported by PatchstackMedium 6.5
• Oct 8, 2024LatePoint: Authentication bypassCVE-2024-8943 · fixed in 5.0.13 · reported by Wordfence3.1% oddsCritical 9.8
• Oct 8, 2024LatePoint: Arbitrary User Password ChangeCVE-2024-8911 · affects up to 5.0.11 · reported by Wordfence2.9% oddsCritical 9.8
• Sep 17, 2024LatePoint: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43992 · affects up to 4.9.91 · reported by PatchstackMedium 6.5
• Jun 14, 2024LatePoint: Unauthorized access of data and modification of dataCVE-2024-2472 · affects up to 4.9.9 · reported by WordfenceCritical 9.1

Records come from the National Vulnerability Database, published by the researchers who found each flaw (Wordfence, Patchstack, WPScan and others); exploited status from CISA; exploit odds from FIRST’s EPSS; current version, installs and closures from wordpress.org, checked daily. Want every plugin on your site checked at once? Run the free website check.