The LatePoint calendar booking plugin for WordPress contains a stored cross‑site scripting flaw that arises when an attacker supplies a crafted value to the 'id' attribute of the 'latepoint_resources' shortcode. Because the plugin does not properly sanitise or escape the input, the supplied value is persisted and rendered unescaped in generated pages, allowing the attacker to inject arbitrary JavaScript. The attack requires only that the user be authenticated with at least Contributor privileges, and any subsequent visitor to a page that includes the malicious shortcode will execute the injected script, potentially leading to credential theft, session hijacking, or defacement. The flaw is listed as a moderate severity vulnerability (CVSS 6.4).

This issue affects the LatePoint – Calendar Booking Plugin for Appointments and Events, a WordPress plugin available from the latepoint vendor. All releases up to and including version 5.1.94 are impacted. Users installing or upgrading to these releases should be aware that the plugin’s shortcode handling is insecure for authenticated contributors and above.

The vulnerability is exploitable locally by any authenticated user with Contributor level or higher access. The EPSS score is below 1 %, indicating a very low probability that this issue will be actively exploited at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw allows arbitrary script execution on pages viewed by other users, the potential damage is significant if the attacker can obtain or elevate credentials to reach the Contributor role. The CVSS score of 6.4 reflects a moderate risk, but organisations should prioritise remediation to prevent a potential credential compromise or user environment compromise.