Latepoint is a scheduling and appointment management platform whose vulnerability profile centers on web-application input handling and access control, with recurring issues spanning SQL injection, cross-site scripting, authentication bypass, and CSRF. The exposure pattern reflects the trust-boundary and input-validation challenges typical of web-facing booking systems that accept and process user-supplied data. Current severity, exploitation, and exposure counts are shown alongside this summary.
The number and severity of CVEs published that impact products developed by Latepoint over time
Signals from CVEs in this vendor scope (8 CVEs).
8 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2024-8943CRITICAL The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. This is due to insufficient verification on the user being supp | Oct 8, 2024 | 9.8 | 41 | NO | YES |
CVE-2026-57714CRITICAL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in LatePoint LatePoint latepoint allows Blind SQL Injection.This issue affects La | Jul 13, 2026 | 9.3 | 40 | NO | NO |
CVE-2024-8911CRITICAL The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to, and including, 5.0.11. This is due to insufficient escaping | Oct 8, 2024 | 9.8 | 40 | NO | YES |
CVE-2026-49083HIGH Contributor Privilege Escalation in LatePoint <= 5.5.1 versions. | Jun 15, 2026 | 7.5 | 30 | NO | NO |
CVE-2024-2472CRITICAL The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the 'start_or_use_session_for_c | Jun 14, 2024 | 9.1 | 26 | NO | NO |
CVE-2024-43945HIGH Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.This issue affects LatePoint: from n/a through 4.9.91. | Oct 21, 2024 | 8.8 | 24 | NO | NO |
CVE-2025-30836MEDIUM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LatePoint LatePoint latepoint allows Stored XSS.This issue affects LatePoint: | Mar 27, 2025 | 6.5 | 19 | NO | NO |
CVE-2024-43992MEDIUM Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Latepoint LatePoint allows Stored XSS.This issue affects LatePoint: fro | Sep 18, 2024 | 5.4 | 16 | NO | NO |
Signals from CVEs in this vendor scope (8 CVEs).
An overview of all social media posts that mention a CVE ID that affects a product developed by Latepoint.
Media articles that mention a CVE ID that affects a product developed by Latepoint — matched by CVE ID, not by vendor name.