Stored Cross-Site Scripting Vulnerability in LatePoint Calendar & Scheduling Plugin for WordPress
CVE-2026-119152

5.4MEDIUM

Key Information:

Vendor

WordPress
Status
Appointment Booking Plugin – Latepoint | Calendar & Scheduling For WordPress
Vendor
CVE Published:
7 November 2026

What is CVE-2026-119152?

The LatePoint Calendar & Scheduling plugin for WordPress has a vulnerability that allows unauthenticated attackers to exploit the 'customer[email]' parameter. Due to inadequate input sanitization and output escaping, it's possible for malicious actors to inject harmful web scripts into pages. When an unregistered user accesses an injected page, these scripts will execute, leading to potential data compromise or user session hijacking. Attackers can leverage this flaw by registering as a LatePoint customer through the public booking form, entering a specially crafted email address that is processed by the system without proper sanitization.

Affected Version(s)

Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress 0 <= 5.7.6

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/latepoint/tags...
https://plugins.trac.wordpress.org/browser/latepoint/tags...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Maciej Komorowski
.