Stored cross‑site scripting occurs when unsanitized input is saved in the database and later displayed on a web page. In LatePoint, the plugin accepts user‑generated content that is rendered without proper neutralization, giving an attacker the ability to inject JavaScript. Successful exploitation could let an attacker run scripts in the context of authenticated users, potentially hijacking sessions, defacing site content, or distributing malware.

WordPress sites that use the LatePoint booking plugin version 5.1.6 or earlier are affected. The vulnerability is present in all releases from the initial release through 5.1.6, as the input handling was never corrected before that point.

The CVSS score of 6.5 indicates medium severity, but the EPSS score is below 1%, suggesting that exploitation is currently rare. The attack vector that the description implies is a stored XSS, where an attacker likely submits malicious content via the plugin’s input fields while logged in or through an exposed management interface. Because the exploit requires write access to plugin data, the risk is limited to users who can add or modify booking information. The vulnerability is not currently listed in CISA KEV, indicating no known mass‑deployment attacks yet.