Vulnerability history

Admin+ Stored XSS vulnerability

Unauthenticated Payment Bypass vulnerability

Agent+ Customer PII Disclosure vulnerability

Unauthenticated Authentication Bypass vulnerability

Unauthenticated Sensitive Information Disclosure vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Information Disclosure vulnerability

Unauthenticated Authentication Bypass to Customer Account Takeover vulnerability

Authenticated (Subscriber+) Sensitive Information Exposure in 'first_name' Parameter Template Re-expansion vulnerability

Unauthenticated SQL Injection vulnerability

Authenticated (Custom+) Privilege Escalation to 'settings[default_wp_role_for_customer]' Parameter vulnerability

Insecure Direct Object Reference to Authenticated (Subscriber+) Unauthorized Booking Creation and Sensitive Information Disclosure vulnerability

Agent+ Cross-Agent Data Disclosure and Modification vulnerability

Agent+ Arbitrary Order, Customer and Transaction Deletion vulnerability

Unauthenticated Customer PII Disclosure vulnerability

Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary Customer PII Modification vulnerability

Insecure Direct Object Reference to Unauthenticated Unauthorized Transaction Intent Creation/Modification and Invoice Enumeration vulnerability

Unauthenticated Arbitrary Shortcode Execution vulnerability

Authenticated (Custom+) Insecure Direct Object Reference to Arbitrary Booking Deletion and Customer/Booking Data Disclosure vulnerability

Unauthenticated Insecure Direct Object Reference to Sensitive Information Disclosure vulnerability

Unauthenticated Booking Object Mass Assignment via Public Booking Funnel vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

SQL Injection vulnerability

Missing Authorization to Unauthenticated Arbitrary Customer Data Modification vulnerability

Unauthenticated Insecure Direct Object Reference to Arbitrary Creation vulnerability

Authenticated (Custom+) Privilege Escalation to Administrator vulnerability

Cross-Site Request Forgery vulnerability

Privilege Escalation vulnerability

Cross-Site Request Forgery vulnerability

Unauthenticated Account Takeover vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Authenticated (Subscriber+) Stored Cross-Site Scripting vulnerability

Unauthenticated Stored Cross-Site Scripting vulnerability

Authenticated (Agent+) Privilege Escalation to Administrator via 'connect-customer-to-wp-user' Ability vulnerability

Insecure Direct Object Reference to Unauthenticated Sensitive Financial Data Exposure via Sequential Invoice ID vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Insecure Direct Object References (IDOR) vulnerability

WordPress LatePoint - Calendar Booking Plugin for Appointments and Events plugin <= 5.2.7 - Cross-Site Request Forgery in Booking Form Settings Update to Stored Cross-Site Scripting vulnerability

Authenticated (Agent+) Privilege Escalation vulnerability

Authenticated (Administrator+) SQL Injection via JSON Import vulnerability

WordPress LatePoint - Calendar Booking Plugin for Appointments and Events plugin <= 5.2.5 - Cross-Site Request Forgery vulnerability

WordPress LatePoint - Calendar Booking Plugin for Appointments and Events plugin <= 5.2.6 - Missing Authorization to Booking Details Exposure vulnerability

WordPress LatePoint - Calendar Booking Plugin for Appointments and Events plugin <= 5.2.5 - Unauthenticated Stored Cross-Site Scripting vulnerability

Cross-Site Request Forgery to Account Takeover via change_password() Function vulnerability

Unauthenticated Authentication Bypass via load_step Function vulnerability

Authenticated (Administrator+) Stored Cross-Site Scripting vulnerability

Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Unauthenticated LFI vulnerability

Unauthenticated Insecure Direct Object Reference vulnerability

Cross Site Scripting (XSS) vulnerability

Authentication Bypass vulnerability

Unauthenticated Arbitrary User Password Change via SQL Injection vulnerability

Cross Site Scripting (XSS) vulnerability

Cross Site Request Forgery (CSRF) vulnerability

Missing Authorization and Sensitive Information Exposure via IDOR vulnerability