Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.5. This is due to the 'call_by_route_name' function in the routing layer only validating user capabilities without enforcing nonce verification. This makes it possible for unauthenticated attackers to perform multiple administrative actions via forged requests granted they can trick a site administrator into performing an action such as clicking on a link.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
CVE-2025-14873 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and includ… https://www.cve.org/CVERecord?id=CVE-2025-14873
Post summary
The post announces that the LatePoint WordPress plugin is vulnerable to CSRF in all versions up to the listed CVE, with no evidence of a PoC, exploitation, patches, or mitigation steps.
CVE-2025-14873 Cross-Site Request Forgery in LatePoint WordPress Plugin ... https://vulmon.com/vulnerabilitydetails?qid=CVE-2025-14873 Don't wait vulnerability scanning results: https://alerts.vulmon.com/?utm_source=twitter&utm_medium=social&utm_campaign=2102281&utm_content=2
Post summary
The post announces a new CSRF vulnerability (CVE‑2025‑14873) affecting the LatePoint WordPress Plugin, linking to a vulnerability details page but offering no exploit, patch, or evidence of active exploitation.
⚡ New CVE Alert: CVE-2025-14873 📊 Severity: 4.3 🚨 Risk Level: Medium 🧩 Affects: Wordpress Reference: https://nvd.nist.gov/vuln/detail/CVE-2025-14873 #CVE-2025-14873 #CVE #Medium #Wordpress #CyberSecurity #InfoSec https://t.co/1J6so3lo2S
Post summary
A brief tweet announcing the new CVE‑2025‑14873 with a severity score of 4.3 affecting WordPress, including an NVD reference.