LatePoint, a WordPress plugin that manages calendar booking and appointments, contains a stored cross‑site scripting flaw in versions up to 5.5.0. The flaw arises when customer profile information—first name, last name, phone, and notes—are stored without input sanitization and later inserted into notification template previews without HTML escaping. This allows an attacker to inject malicious scripts that execute in the context of any administrator or agent who views a notification preview that includes customer variables such as {{customer_full_name}}. The vulnerability can compromise the confidentiality, integrity, and availability of the administrative interface: an attacker who logs in with a subscriber‑level account can persistently embed scripts that may exfiltrate data, hijack sessions, or modify the user interface. Because the malicious code runs in the victim’s browser, any user who views the affected preview is at risk. Although the impact is limited to the browser context, it can be leveraged for credential theft, phishing, or further lateral movement. The risk level is moderate with a CVSS score of 6.4. No EPSS value is available, and the vulnerability is not listed in the CISA KEV catalog. Attackers must be authenticated with subscriber or higher privileges to trigger the vulnerability, but once the malicious script is inserted into the database it can be activated by any administrator or agent who performs a notification preview. The lack of proper output escaping makes the issue difficult to avoid without applying the vendor’s patch.

LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress, all releases through and including version 5.5.0. No specific platform variants are listed; the plugin runs on any standard WordPress installation that has not applied an update beyond 5.5.0.

With a moderate CVSS score of 6.4 the vulnerability poses a tangible threat to site administrators, particularly if the site uses the notification preview feature. Exploitation requires valid authenticated credentials with subscriber or higher role, but once a payload is stored it triggers whenever a notification template referencing customer data is previewed. The absence of an EPSS score or KEV listing suggests current public exploitation activity is unknown, yet the broad availability of the plugin and its common use in booking contexts make the risk non‑negligible.