Vulnerability history

Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure vulnerability

Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability

Unauthenticated Booking Object Mass Assignment via Public Booking Funnel vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

SQL Injection vulnerability

Missing Authorization to Unauthenticated Arbitrary Customer Data Modification vulnerability

Unauthenticated Insecure Direct Object Reference to Arbitrary Creation vulnerability

Authenticated (Custom+) Privilege Escalation to Administrator vulnerability

Cross-Site Request Forgery vulnerability

Privilege Escalation vulnerability

Cross-Site Request Forgery vulnerability

Unauthenticated Account Takeover vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Insecure Direct Object References (IDOR) vulnerability

WordPress LatePoint - Calendar Booking Plugin for Appointments and Events plugin <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting vulnerability

Authenticated (Agent+) Privilege Escalation vulnerability

Authenticated (Administrator+) SQL Injection via JSON Import vulnerability

WordPress LatePoint - Calendar Booking Plugin for Appointments and Events plugin <= 5.2.5 - Cross-Site Request Forgery vulnerability

WordPress LatePoint - Calendar Booking Plugin for Appointments and Events plugin <= 5.2.6 - Missing Authorization to Booking Details Exposure vulnerability

WordPress LatePoint - Calendar Booking Plugin for Appointments and Events plugin <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Account Takeover via change_password() Function vulnerability

Unauthenticated Authentication Bypass via load_step Function vulnerability

Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Unauthenticated LFI vulnerability

Unauthenticated Insecure Direct Object Reference vulnerability

Cross Site Scripting (XSS) vulnerability

Authentication Bypass vulnerability

Unauthenticated Arbitrary User Password Change via SQL Injection vulnerability

Cross Site Scripting (XSS) vulnerability

Cross Site Request Forgery (CSRF) vulnerability

Missing Authorization and Sensitive Information Exposure via IDOR vulnerability