An unauthenticated attacker can insert arbitrary script code into the booking_form_page_url parameter of the LatePoint plugin. Because the input is neither sanitized nor properly escaped before being written to the database, the malicious script is stored and executed whenever a user views the page that references the injected URL. The flaw satisfies the weakness identified as CWE‑79 and can be used to compromise the confidentiality and integrity of user interactions with the website, including session hijacking and defacement of content.

All WordPress sites running LatePoint – Calendar Booking Plugin for Appointments and Events version 5.5.0 or earlier are affected. The vulnerability exists in every release up to and including 5.5.0; later releases are believed to contain mitigations.

The CVSS score for the flaw is 7.2, indicating a high severity. EPSS information is not available, and the vulnerability is not listed in CISA's KEV catalog. Attackers do not need prior authentication or any special permissions; any user who can access the vulnerable parameter can inject the payload. Because the injection point is stored in the database, the compromise persists until the entry is removed or the plugin is updated. The lack of a required plugin configuration for exploitation (Stripe integration is optional) further lowers the barrier to attack.