The LatePoint – Calendar Booking Plugin for Appointments and Events contains a Cross‑Site Request Forgery (CSRF) flaw in its reload_preview() function due to missing or incorrect nonce validation. An unauthenticated attacker can forge a request that updates booking form settings and injects malicious JavaScript, which is then stored in the database. When an administrator or authenticated user later views the updated settings, the injected script executes, creating a stored Cross‑Site Scripting (XSS) vulnerability. This can compromise the confidentiality, integrity, and availability of the site by allowing execution of arbitrary code within the administrative context.

All releases of the LatePoint – Calendar Booking Plugin for Appointments and Events with a version number of 5.2.7 or earlier are affected. The vendor responsible is latepoint. No further version ranges are specified beyond the stated upper bound.

The CVSS score of 6.1 indicates a medium severity vulnerability. The EPSS score of less than 1% suggests a low overall exploitation probability, and the vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to convince a site administrator to click a forged link or otherwise submit the crafted request, a form of social engineering that is common but not guaranteed.