CVE-2026-105258
LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
CVSS Score
0.0
EPSS Score
0.0%
EPSS Percentile
0th
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
| Vendor | unknown |
| Product | appointment booking plugin |
| Published | Oct 29, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown appointment booking plugin
Be the first to know when new unknown vulnerabilities affecting unknown appointment booking plugin are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Appointment Booking Plugin
0 < 5.7.6
References
Credits
Karthik Ramakrishnan WPScan