What is the CVSS score of CVE-2026-4785?

CVE-2026-4785 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

WordPress CVE-2026-4785

EUVD-2026-20048 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-04-08 Wordfence

GHSA-8xj5-wfhm-66px

WordPress XSS

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

EUVD ID Assigned

Apr 08, 2026 - 04:30 euvd

EUVD-2026-20048

Analysis Generated

Apr 08, 2026 - 04:30 vuln.today

CVE Published

Apr 08, 2026 - 03:36 nvd

MEDIUM 6.4

DescriptionCVE.org

The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' parameter in the [latepoint_resources] shortcode in versions up to and including 5.3.0. This is due to insufficient output escaping when the 'items' parameter is set to 'bundles'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in LatePoint Calendar Booking Plugin for WordPress up to version 5.3.0 allows authenticated contributors and above to inject arbitrary JavaScript via the 'button_caption' parameter in the [latepoint_resources] shortcode when 'items' is set to 'bundles'. The injected scripts execute for all users viewing the affected page. No public exploit code or active exploitation has been identified, though the vulnerability requires only contributor-level access and automatic exploitation is feasible.

Technical ContextAI

The vulnerability exists in the shortcodes_helper.php file of the LatePoint plugin, specifically in the [latepoint_resources] shortcode handler. When processing the 'items' parameter set to 'bundles', the plugin fails to properly escape output of the 'button_caption' parameter before rendering it in HTML context. This is a classic Stored XSS vulnerability (CWE-79: Improper Neutralization of Input During Web Page Generation) where user-supplied input is stored in the WordPress database and later rendered without sanitization. The affected code path shows insufficient use of WordPress security functions (such as esc_html() or wp_kses_post()) when outputting shortcode attributes, allowing JavaScript execution when the page is viewed.

RemediationAI

Update LatePoint to a version released after the fix changeset 3491516 (https://plugins.trac.wordpress.org/changeset/3491516/latepoint), which addresses the insufficient output escaping in shortcodes_helper.php. The plugin should be updated through the WordPress plugins dashboard or manually from https://plugins.wordpress.org/latepoint/. If immediate patching is not possible, temporarily restrict contributor-level access to users who are fully trusted, and audit all existing [latepoint_resources] shortcodes with 'items=bundles' for suspicious 'button_caption' values. Site administrators should review plugin revision history and consider rolling back to a known-safe version if exploitation is suspected.