CVE-2026-4785

MEDIUM 6.4

LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

CVSS Score

6.4

EPSS Score

0.0%

EPSS Percentile

11th

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' parameter in the [latepoint_resources] shortcode in versions up to and including 5.3.0. This is due to insufficient output escaping when the 'items' parameter is set to 'bundles'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CWE	CWE-79
Vendor	latepoint
Product	latepoint – calendar booking plugin for appointments and events
Published	Apr 8, 2026
Last Updated	Apr 8, 2026

Stay Ahead of the Next One

Get instant alerts for latepoint latepoint – calendar booking plugin for appointments and events

Be the first to know when new medium vulnerabilities affecting latepoint latepoint – calendar booking plugin for appointments and events are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

CVSS v3 Breakdown

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Scope

Confidentiality

Integrity

Availability

Affected Versions

latepoint / LatePoint – Calendar Booking Plugin for Appointments and Events

0 ≤ 5.3.0

References

NVD ↗ CVE.org ↗ EPSS Data ↗

Credits

Djaidja Moundjid