CVE-2026-4785
MediumCVSS 6.4Exploitation Probability (EPSS)
Low risk29th percentile - higher than 29% of all known CVEs
Summary
The LatePoint plugin for WordPress up to version 5.3.0 contains a Stored XSS vulnerability via the 'button_caption' parameter in the [latepoint_resources] shortcode. Attackers with contributor-level access or higher can inject arbitrary scripts that execute when a user visits the page.
Risk Assessment
The risk involves potential session hijacking, data theft, or further attacks on the site through malicious script execution in the victim's browser context.
Recommendation
Immediately update the LatePoint plugin to the latest available version that fixes this vulnerability.
Original NVD description (English source)
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' parameter in the [latepoint_resources] shortcode in versions up to and including 5.3.0. This is due to insufficient output escaping when the 'items' parameter is set to 'bundles'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.