What is the CVSS score of EUVD-2026-53864?

EUVD-2026-53864 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

LatePoint EUVD-2026-53864

| CVE-2026-5391 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-08-06 Wordfence

GHSA-hg94-gfmw-xvqm

WordPress XSS Latepoint Wordpress Plugin Appointment Booking Plugin Latepoint Calendar Scheduling For Wordpress

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

Stored XSS requires victim page visit (UI:R per spec, not UI:N); contributor access required (PR:L); JavaScript executes in victim browser crossing scope boundary (S:C).

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Aug 06, 2026 - 12:24 vuln.today

CVE Published

Aug 06, 2026 - 11:29 nvd

MEDIUM 6.4

DescriptionCVE.org

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

AnalysisAI

Stored Cross-Site Scripting in the LatePoint WordPress appointment booking plugin (all versions through 5.3.2) allows authenticated attackers with contributor-level access to inject persistent malicious scripts via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. The injected payload executes in any visitor's browser upon loading the affected page, enabling session hijacking, credential theft, or malicious redirects against site users. No public exploit code or active exploitation has been identified at time of analysis; however, the low privilege requirement expands the attacker pool on multi-contributor WordPress deployments.

Technical ContextAI

The vulnerability resides in the LatePoint Appointment Booking and Scheduling plugin for WordPress (CPE: cpe:2.3:a:latepoint:appointment_booking_plugin_-_latepoint_|_calendar_&_scheduling_for_wordpress:*:*:*:*:*:*:*:*), reported by Wordfence. CWE-79 (Improper Neutralization of Input During Web Page Generation - Cross-site Scripting) identifies the root cause: the 'shortcode_latepoint_resources' function processes the 'btn_wrapper_classes' shortcode attribute through the 'locations' branch without applying sufficient input sanitization or output escaping before rendering it into the HTML page. The attribute value is stored in post content and later emitted directly to the DOM, allowing arbitrary JavaScript to be persisted and executed in victims' browsers. The confirmed code-level fix is visible in WordPress plugin Trac changeset 3505127 targeting shortcodes_helper.php.

RemediationAI

Update the LatePoint plugin to the version released after 5.3.2 that incorporates changeset 3505127 in shortcodes_helper.php; the exact patched release version number is not independently confirmed from the available input data, so verify via the WordPress plugin repository that the installed version reflects or supersedes this changeset (https://plugins.trac.wordpress.org/changeset/3505127/latepoint/trunk/lib/helpers/shortcodes_helper.php). As an interim compensating control, audit and restrict contributor-level and above accounts to only trusted users, as WordPress's role/capability system determines who can publish posts containing shortcodes - removing untrusted contributors eliminates the primary attack vector without disabling the plugin. A Web Application Firewall rule targeting script injection patterns in shortcode attribute values can provide additional defense-in-depth but introduces a risk of false positives on legitimate class names and does not substitute for patching.