The vulnerability is a stored cross‑site scripting flaw in the unknown field handling of the customer email input. Due to insufficient input sanitization and missing output escaping, an attacker can embed malicious JavaScript in the quoted local‑part of an email address that passes PHP’s email validation routine. The injected script is persisted in the database and rendered unescaped on the customers list page, causing the code to execute whenever a venue stakeholder or any user renders the page. The weakness is classified as CWE‑79, leading to client‑side code execution, which can facilitate phishing, credential theft, or defacement.

LatePoint Appointment Booking Plugin – LatePoint, Calendar & Scheduling for WordPress, available for WordPress installations up to and including version 5.7.6. All earlier releases are also affected as the root issue exists in the same code path.

The CVSS score of 5.4 indicates a medium severity, and the lack of authentication requirement makes the exploit trivial for any internet visitor. Although EPSS data is not available and the vulnerability is not currently listed in CISA’s KEV catalog, the potential impact on user sessions and the wide deployment of WordPress suggests that the risk should be treated as high for sites still running a vulnerable version. The primary attack vector is through the public booking form, which allows anyone to create a customer record containing a malicious email address without needing any credentials.