EUVD-2026-27544
GHSA-c4v2-4wg6-3r8x
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
Lifecycle Timeline
1DescriptionCVE.org
The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.5.0. This is due to insufficient input sanitization on the customer cabinet profile update endpoint - where raw POST parameters (first_name, last_name, phone, notes) bypass sanitization because OsCustomerModel does not override params_to_sanitize(), causing set_data() to store unsanitized values verbatim in the database - combined with insufficient output escaping in generate_preview(), which injects those stored values into notification template HTML via str_replace() without any esc_html() call before echoing the result. This makes it possible for authenticated attackers with customer-level access or above to inject arbitrary web scripts into the admin notification preview panel that execute in an administrator's or agent's browser whenever a notification template referencing customer variables such as {{customer_full_name}}, {{customer_first_name}}, {{customer_last_name}}, {{customer_phone}}, or {{customer_notes}} is previewed.
AnalysisAI
Stored cross-site scripting in LatePoint calendar booking plugin for WordPress versions up to 5.5.0 allows authenticated customers to inject malicious scripts via unsanitized profile fields (first name, last name, phone, notes) that execute in administrators' browsers when notification templates are previewed. Exploitation requires customer-level access and admin interaction to preview a notification template, but achieves code execution in a high-privilege context (administrator or agent browser session) with scope change from single user to multiple users.
Technical ContextAI
LatePoint is a WordPress appointment and calendar booking plugin. The vulnerability stems from two combined weaknesses in the plugin's data flow: first, the OsCustomerModel class fails to override the params_to_sanitize() method, causing the set_data() function to store raw POST parameters (first_name, last_name, phone, notes) directly in the database without sanitization; second, the generate_preview() function in the notification template system retrieves these stored values and injects them into HTML via str_replace() without any esc_html() escaping before output. Notification templates use placeholder variables like {{customer_full_name}}, {{customer_first_name}}, {{customer_last_name}}, {{customer_phone}}, and {{customer_notes}} that are directly replaced with unsanitized database values. This is a classic stored XSS (CWE-79) vulnerability where untrusted input is persisted and later rendered in a different security context.
RemediationAI
Update LatePoint to a patched version released after the vulnerability disclosure (patch version not specified in provided data; check WordPress plugin repository for latest stable release). The upstream fix involves two mandatory changes: (1) OsCustomerModel must override params_to_sanitize() to explicitly include the vulnerable fields in the sanitization list, ensuring set_data() sanitizes first_name, last_name, phone, and notes before database storage; (2) generate_preview() must apply esc_html() or appropriate escaping function to all customer variable values before injecting them into template HTML output via str_replace(). Until patched, no adequate workaround exists without disabling notification template preview functionality entirely (which impacts admin usability). A temporary compensating control is to restrict customer cabinet access via IP whitelist or require multi-factor authentication for admin/agent accounts; this reduces attack surface but does not eliminate the vulnerability since any authenticated customer can still inject payloads. Additionally, administrators can audit existing customer records for suspicious characters in first_name, last_name, phone, or notes fields via database inspection and remove malicious entries, but this is manual and does not prevent new injections. Detailed patch guidance is available in Wordfence vulnerability report at https://www.wordfence.com/threat-intel/vulnerabilities/id/628b3f53-decd-47ac-a2d1-339ade1e6944.
The LatePoint plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 5.0.12. Rate
The LatePoint plugin for WordPress is vulnerable to Arbitrary User Password Change via SQL Injection in versions up to,
The LatePoint Plugin plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a
Blind SQL injection in the LatePoint WordPress appointment-booking plugin (versions up to and including 5.6.3) lets remo
Privilege escalation in the LatePoint booking plugin for WordPress (versions ≤ 5.4.1) lets an authenticated user holding
Privilege escalation to Administrator in the LatePoint booking plugin for WordPress (versions up to and including 5.6.3)
Cross-Site Request Forgery (CSRF) vulnerability in Latepoint LatePoint allows Cross Site Request Forgery.9.91. Rated hig
Privilege escalation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.5.1) allows
Payment amount manipulation in the LatePoint Calendar Booking plugin for WordPress (versions up to and including 5.4.0)
Privilege escalation in the LatePoint WordPress plugin versions 5.5.1 and earlier allows authenticated users holding low
Stored Cross-Site Scripting in LatePoint Calendar Booking Plugin for WordPress allows unauthenticated remote attackers t
Stored cross-site scripting (XSS) in LatePoint WordPress booking plugin (versions ≤5.5.0) allows unauthenticated attacke
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today