EUVD-2026-20048
GHSA-8xj5-wfhm-66px
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Output encoding, context-aware escaping
MITRE ATT&CK
2 techniques across 2 tactics: Initial Access, Execution The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Impact | This vulnerability presents a moderate-to-elevated real-world risk for WordPress installations using LatePoint. The CVSS vector (AV:N/AC:L/PR:L/UI:N/S:C) indicates network-accessible attack with low complexity and no user interaction required, but requires authenticated access at contributor level or above. The EPSS probability cannot be calculated from provided data, but the combination of relatively low privilege barrier (contributor, not admin), non-interactive exploitation (UI:N), and scope change (affects other users: S:C) creates a meaningful risk, particularly for multi-author WordPress sites. The stored nature means impact is persistent and affects all site visitors. However, this is not a critical remote-code-execution vulnerability and requires some level of account compromise or insider threat. For sites with strict contributor management and minimal untrusted user access, risk is lower; for open multi-author sites or networks with permissive contributor roles, risk is elevated. |
| Exploit ScenarioDerived | A malicious contributor or user with contributor-level access creates or edits a page containing the [latepoint_resources items='bundles'] shortcode and injects JavaScript such as |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Apr 08, 2026
Stored Cross-Site Scripting in LatePoint Calendar Booking Plugin for WordPress up to version 5.3.0 allows authenticated contributors and above to inject arbitrary JavaScript via the 'button_caption' parameter in the [latepoint_resources] shortcode when 'items' is set to 'bundles'. The injected scripts execute for all users viewing the affected page. No public exploit code or active exploitation has been identified, though the vulnerability requires only contributor-level access and automatic exploitation is feasible.
RemediationAI
Update LatePoint to a version released after the fix changeset 3491516 (https://plugins.trac.wordpress.org/changeset/3491516/latepoint), which addresses the insufficient output escaping in shortcodes_helper.php. The plugin should be updated through the WordPress plugins dashboard or manually from https://plugins.wordpress.org/latepoint/. If immediate patching is not possible, temporarily restrict contributor-level access to users who are fully trusted, and audit all existing [latepoint_resources] shortcodes with 'items=bundles' for suspicious 'button_caption' values. Site administrators should review plugin revision history and consider rolling back to a known-safe version if exploitation is suspected.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability exists in the shortcodes_helper.php file of the LatePoint plugin, specifically in the [latepoint_resources] shortcode handler. When processing the 'items' parameter set to 'bundles', the plugin fails to properly escape output of the 'button_caption' parameter before rendering it in HTML context. This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where user-supplied input is stored in the WordPress database and later rendered without sanitization. The affected code path shows insufficient use of WordPress security functions (such as esc_html() or wp_kses_post()) when outputting shortcode attributes, allowing JavaScript execution when the page is viewed.
Know when Latepoint gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from Vendor (Wordfence) · only source for this CVE.
CVSS VectorVendor: Wordfence
DescriptionCVE.org
The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' parameter in the [latepoint_resources] shortcode in versions up to and including 5.3.0. This is due to insufficient output escaping when the 'items' parameter is set to 'bundles'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
VulDB
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Cross-Site Scripting occurs when an application accepts untrusted data and sends it to a web browser without proper validation or encoding.
The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. Rate
The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to,
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a
Price tampering in the LatePoint WordPress booking plugin before 5.7.5 lets a remote unauthenticated visitor manipulate
Blind SQL injection in the LatePoint WordPress appointment-booking plugin (versions up to and including 5.6.3) lets remo
LatePoint WordPress plugin through 5.7.4 allows unauthenticated remote attackers who know a target customer's registered
Unauthenticated arbitrary shortcode execution in LatePoint (Appointment Booking Plugin - Calendar & Scheduling for WordP
Privilege escalation in the LatePoint appointment booking plugin for WordPress (all versions up to and including 5.7.3)
Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding
Privilege escalation to Administrator in the LatePoint booking plugin for WordPress (versions up to and including 5.6.3)
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.9.91. Rated hig
Privilege escalation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.5.1) allows
Exploit-DB