What is the CVSS score of CVE-2026-7448?

CVE-2026-7448 has a CVSS 3.1 base score of 7.2 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.1%.

Which versions of LatePoint WordPress Plugin are affected by CVE-2026-7448?

LatePoint Calendar Booking Plugin versions through 5.5.0 contain a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious code through appointment booking…

How to fix or mitigate CVE-2026-7448?

Within 24 hours: Identify all WordPress installations running LatePoint Calendar Booking Plugin and document current version numbers; disable or restrict public access to booking forms if operationally feasible. Within 7 days: Implement Web Application Firewall rules to sanitize first_name parameter input and block JavaScript patterns in appointment submissions; apply Content Security Policy headers to prevent inline script execution. Within 30 days: Monitor LatePoint vendor advisories for patched version release and test in staging environment; plan immediate deployment upon availability; consider alternative booking plugins with active security maintenance if vendor patch timeline extends beyond 60 days.

LatePoint WordPress Plugin CVE-2026-7448

EUVD-2026-27542 HIGH

Cross-site Scripting (XSS) (CWE-79)

2026-05-06 Wordfence

GHSA-mj2w-r8cc-jq9c

WordPress XSS Latepoint Latepoint Calendar Booking Plugin For Appointments And Events Wordpress Plugin

7.2

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

7.2 HIGH

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

May 06, 2026 - 07:46 vuln.today

DescriptionCVE.org

The LatePoint - Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 5.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in LatePoint Calendar Booking Plugin for WordPress allows unauthenticated remote attackers to inject malicious JavaScript via the 'first_name' parameter in appointment booking forms, affecting all versions through 5.5.0. The injected scripts persist in the database and execute whenever administrators or other users view booking records, potentially enabling session hijacking, privilege escalation, or further attacks against site administrators. The CVSS vector indicates network-accessible exploitation with no authentication required and changed scope, enabling attacks beyond the vulnerable component. EPSS score not provided; no confirmation of active exploitation (not in CISA KEV) or public exploit code at time of analysis.

Technical ContextAI

This vulnerability affects the LatePoint appointment booking plugin for WordPress (cpe:2.3:a:latepoint:latepoint_-_calendar_booking_plugin_for_appointments_and_events), specifically in customer data handling across multiple components: activities_controller.php (line 270), customer_model.php (line 376), replacer_helper.php (line 276), and email_helper.php (line 50). The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), commonly known as Cross-Site Scripting. The flaw stems from insufficient input sanitization when processing the 'first_name' field during appointment creation and inadequate output escaping when displaying this data in administrative interfaces and email templates. Unlike reflected XSS, this stored variant persists the malicious payload in the WordPress database, making it execute repeatedly across multiple user sessions without requiring the attacker to repeatedly deliver the payload. The code references show the vulnerable data flow from user input through model storage to output rendering without proper HTML entity encoding or Content Security Policy protections.

RemediationAI

Upgrade LatePoint - Calendar Booking Plugin for Appointments and Events to a version newer than 5.5.0 that incorporates changeset 3522933 or later from the WordPress plugin repository, which addresses the input sanitization and output escaping deficiencies. The specific patched version number is not independently confirmed from available data-verify the latest stable release from the WordPress plugin directory or contact the vendor directly. Review existing appointment records for suspicious content in customer first_name fields using SQL queries against the WordPress database (wp_latepoint_customers table or equivalent), searching for common XSS patterns like <script>, onerror=, or javascript: URIs. If immediate patching is not feasible, implement compensating controls: restrict access to administrative booking management interfaces using IP allowlisting or VPN requirements (reduces exposure to stored payload execution but does not prevent injection); enable WordPress Content Security Policy headers via security plugins to limit inline script execution (may break legitimate plugin functionality-test thoroughly); implement Web Application Firewall rules to block common XSS patterns in POST requests to booking endpoints (pattern-based detection has bypass risks). Database sanitization of existing records should be performed carefully to avoid data corruption-consider using WordPress's wp_kses() function with appropriate allowed tags or engaging professional incident response if compromise is suspected. Consult Wordfence advisory at https://www.wordfence.com/threat-intel/vulnerabilities/id/c8eedec9-d8d4-4052-baec-29f83ac306ac for vendor-specific guidance.