Appointment Booking Plugin
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:appointment_booking_plugin:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Appointment Booking Plugin (e96bd51d-04fa-5333-aa06-59e134aa0f04) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-105258 |
vulnerable | 2026-11-03 10:16:33.185158 |
LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
Published: 2026-10-29T06:00:23.853Z
Updated: 2026-10-29T10:56:07.796Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-105257 |
vulnerable | 2026-11-03 10:16:33.022041 |
LatePoint < 5.7.5 - Agent+ Customer PII Disclosure via IDOR
The Appointment Booking Plugin WordPress plugin before 5.7.5 does not verify that an authenticated agent-level user is assigned to a customer before returning or searching that customer's record, allowing any agent to read and enumerate the personal information of every customer on the site, including those managed by other agents.
Published: 2026-10-21T06:00:18.196Z
Updated: 2026-10-21T10:35:09.010Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-15250 |
vulnerable | 2026-09-16 04:33:06.462960 |
LatePoint < 5.6.8 - Unauthenticated Booking Object Mass Assignment via Public Booking Funnel
The Appointment Booking Plugin WordPress plugin before 5.6.8 does not restrict which booking fields an unauthenticated visitor can set through its public booking funnel, allowing an unauthenticated user to assign a privileged booking field such as the approval status and thereby bypass the site's booking approval workflow.
Published: 2026-07-30T06:00:08.816Z
Updated: 2026-07-30T14:41:40.163Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-11866 |
vulnerable | 2026-07-29 00:23:31.741650 |
LatePoint < 5.6.3 - Multiple Privileged Actions via CSRF
The Appointment Booking Plugin WordPress plugin before 5.6.3 does not validate a CSRF nonce on several state-changing actions handled by its central request dispatcher, allowing attackers to perform privileged actions, such as overwriting the booking-form configuration or disconnecting the connected payment gateway, via Cross-Site Request Forgery against a logged-in administrator.
Published: 2026-07-16T06:00:03.056Z
Updated: 2026-07-16T15:33:52.148Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.