Stored Cross-Site Scripting Vulnerability in LatePoint Calendar Booking Plugin for WordPress

CVE-2026-7332

What is CVE-2026-7332?

The LatePoint Calendar Booking Plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability through the 'booking_form_page_url' parameter. This issue arises from inadequate input sanitization and output escaping in versions up to and including 5.5.0. Attackers, even without authentication, can exploit this vulnerability to inject harmful web scripts into the application. The malicious scripts execute upon user access to the compromised pages, and the exploit can occur regardless of whether Stripe integration is present, as the action hook responsible for logging malicious activities is triggered before the Stripe Connect account ID validation.

References