LatePoint <= 5.3.2 Authenticated Stored XSS via Shortcode Attributes (CVE-2026-5391)

Vulnerability Overview Vulnerability Name: LatePoint <= 5.3.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Attributes CVE ID: CVE-2026-5391 CVSS Score: 6.4 (Medium) Release Date: August 5, 2026 Last Updated: August 6, 2026 Researcher: alex_henry20 Affected Scope Affected Software: Appointment Booking Plugin – LatePoint Affected Versions: <= 5.3.2 Fixed Version: 5.4.0 Remediation Fix Measure: Update to version 5.4.0 or later Vulnerability Description A stored Cross-Site Scripting (XSS) vulnerability exists in the LatePoint plugin for WordPress. An attacker can inject malicious scripts through the attribute of the shortcode. The vulnerability resides in the branch of the function, where insufficient input sanitization and output escaping allow the malicious script to execute when a user visits the page. References plugins.trac.wordpress.org Additional Information Software Type: Plugin Software Slug: latepoint Is Fixed: Yes Fixed Version: 5.4.0 Related Recent Vulnerabilities LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.4.0 - Unauthenticated Stripe PaymentIntent Amount Binding Bypass - CVE ID: CVE-2026-5356 - CVSS Score: 7.5 - Researcher: Andrea Cruciani - Release Date: July 7, 2026 LatePoint <= 5.6.1 - Missing Authorization to Unauthenticated Arbitrary Customer Data Modification via process_step_customer() Booking Form Customer Step - CVE ID: CVE-2026-11398 - CVSS Score: 5.3 - Researcher: hhhai - Release Date: July 2, 2026 LatePoint <= 5.6.2 - Unauthenticated Insecure Direct Object Reference to Arbitrary Creation via /service_id Parameter - CVE ID: CVE-2026-12657 - CVSS Score: 5.3 - Researcher: gidget smith - Release Date: July 1, 2026 LatePoint <= 5.6.3 - Authenticated (Custom+) Privilege Escalation to Administrator via /order/customer_id Parameter - CVE ID: CVE-2026-13228 - CVSS Score: 8.8 - Researcher: d_v4n_s3c - Release Date: June 30, 2026 LatePoint <= 5.6.2 - Cross-Site Request Forgery - CVE ID: CVE-2026-11866 - CVSS Score: 4.3 - Researcher: Meher Sudhakar Abbireddi - Release Date: June 25, 2026 LatePoint <= 5.5.1 - Authenticated (Agent+) Privilege Escalation to Administrator via IDOR in OxDashboardController::create_or_update + Unauthenticated Customer-Cabinet Password Reset - CVE ID: CVE-2026-8176 - CVSS Score: 7.5 - Researcher: d_v4n_s3c - Release Date: June 15, 2026 LatePoint <= 5.6.0 - Cross-Site Request Forgery via invoices_change_status Action - CVE ID: CVE-2026-9719 - CVSS Score: 4.3 - Researcher: alex_henry20 - Release Date: June 5, 2026 LatePoint - Calendar Booking Plugin for Appointments and Events <= 5.5.1 - Authenticated (Contributor+) Privilege Escalation - CVE ID: CVE-2026-49083 - CVSS Score: 8.8 - Researcher: VanTastic - Release Date: June 5, 2026 LatePoint <= 5.3.2 - Cross-Site Request Forgery via /customer_cabinet_request_cancellation/ AJAX Route - CVE ID: CVE-2026-5365 - CVSS Score: 4.3 - Researcher: Tulgaasa - Release Date: May 13, 2026 Summary The LatePoint plugin, in versions 5.3.2 and earlier, contains a stored Cross-Site Scripting (XSS) vulnerability. Users are advised to update to version 5.4.0 or later as soon as possible to remediate this issue.

Goal Reached Thanks to every supporter — we hit 100%!

LatePoint <= 5.3.2 Authenticated Stored XSS via Shortcode Attributes (CVE-2026-5391)

More from this source