What the vulnerability does
01Description
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'booking_form_page_url' parameter in all versions up to, and including, 5.5.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious activity log entry is written to the database even when Stripe is not configured, because the latepoint_order_intent_created action hook fires before the Stripe Connect account ID is validated, meaning a fully functional Stripe integration is not required for exploitation.
Explanation of Vulnerability in Simple Terms
02Summary
LatePoint versions up to 5.5.0 contain a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts into the application. An attacker can craft a malicious request that executes JavaScript in users' browsers, potentially stealing session tokens, redirecting users, or performing actions on their behalf. No authentication is required to exploit this vulnerability.
What an attacker can do
03Attacker Capabilities
Inject and execute malicious JavaScript in users' browsers to steal data or perform unauthorized actions.
Potential impact on your site
04Site Impact
Visitors and administrators could have their sessions hijacked, credentials stolen, or be redirected to malicious sites.
Conditions required to exploit
05Prerequisites
Network access to the plugin; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 6, 2026
CVE published
May 6, 2026
Record updated
