The LatePoint plugin contains a stored XSS flaw that allows an authenticated administrator to inject malicious scripts through the service[name] field. Because the input is not sanitized and the output is not escaped, the scripts execute for any user who visits the affected page, potentially exposing session data or executing further malicious actions. The weakness is a classic reflected input injection reflected as a Stored XSS (CWE‑79).

LatePoint – Calendar Booking Plugin for Appointments and Events, a plugin distributed on WordPress. All versions up to and including 5.1.94 are impacted. The vulnerability is only apparent on multi‑site WordPress installations and when the unfiltered_html capability is disabled, conditions that apply to most production sites.

The CVSS score is 5.5, indicating moderate risk. The EPSS score is less than 1%, suggesting a low probability of exploitation at present, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need administrator login credentials, but once obtained, they can inject code that runs in the browser of any site visitor, creating a broad opportunity for credential theft or further compromise. Given the combination of sufficient privileges required, the available exploit path is relatively straightforward.