Stored Cross-Site Scripting in LatePoint Calendar Booking Plugin for WordPress
CVE-2026-7448

7.2HIGH

Key Information:

Vendor

WordPress
Status
Latepoint – Calendar Booking Plugin For Appointments And Events
Vendor
CVE Published:
6 May 2026

What is CVE-2026-7448?

The LatePoint Calendar Booking Plugin for WordPress is susceptible to a Stored Cross-Site Scripting vulnerability via the 'first_name' parameter. This issue occurs due to inadequate input sanitization and output escaping, allowing unauthenticated attackers to execute malicious scripts on affected pages. Users accessing these pages may unknowingly trigger harmful actions, putting their data and security at risk. All versions up to and including 5.5.0 are affected, highlighting a critical need for prompt updates to ensure proper security measures are in place.

Affected Version(s)

LatePoint – Calendar Booking Plugin for Appointments and Events 0 <= 5.5.0

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/browser/latepoint/trun...
https://plugins.trac.wordpress.org/browser/latepoint/tags...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Ramon Mateas
.