LatePoint CVE-2026-5391

Exploitation requires an attacker to hold a WordPress account with at minimum contributor-level role, which grants the capability to create and submit posts containing shortcodes. The specific vulnerable code path is the 'locations' branch of the 'shortcode_latepoint_resources' function, triggered only when the 'latepoint_resources' shortcode is processed - meaning the LatePoint plugin must be active and the shortcode must be present on a page accessible to victims. Sites where contributor-level or higher roles are assigned exclusively to fully trusted internal staff have significantly reduced exposure, as exploitation is blocked without the ability to save crafted shortcode content. The vulnerability does not affect sites where the LatePoint plugin is inactive or where shortcode rendering for contributor-authored content is disabled. No non-default server configuration, special network position, or OS-level access is required; the only prerequisite is the valid WordPress contributor credential.

The vendor CVSS score of 6.4 (Medium) with vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N warrants a critical metric review: per CVSS 3.1 specification, stored XSS that requires a victim to navigate to an injected page should carry UI:R (Required), not UI:N, because the victim's browser visit is a prerequisite for payload execution. The UI:N scoring likely reflects the attacker's perspective only and may overstate ease of exploitation from a victim-impact standpoint. The S:C (scope change) correctly captures the cross-browser-context impact. PR:L accurately reflects the contributor-level access requirement, which is a meaningful but not high barrier on sites with multiple content authors. No EPSS score was provided, and the vulnerability is not listed in the CISA KEV catalog nor does any public POC appear in the referenced data, indicating no confirmed widespread active exploitation. Real-world risk is elevated on collaborative WordPress sites where contributor accounts are granted to semi-trusted or external users, but sites restricting post creation to administrators or editors face substantially lower exposure.

An attacker holding a WordPress contributor account crafts a post embedding the 'latepoint_resources' shortcode with a 'btn_wrapper_classes' attribute containing a JavaScript payload, then publishes or saves the post. Any site user - authenticated or not - who subsequently visits the page triggers automatic execution of the stored script in their browser, which can exfiltrate their session cookie to an attacker-controlled server or perform privileged actions within their session context. No public proof-of-concept has been identified, but the attack requires only basic knowledge of WordPress shortcode syntax and browser developer tools.