{“lastseen”:””,”description”:”The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.5.0. This is due to insufficient input sanitization on the customer cabinet profile update endpoint \u2014 where raw POST parameters (first_name, last_name, phone, notes) bypass sanitization because OsCustomerModel does not override params_to_sanitize(), causing set_data() to store unsanitized values verbatim in the database \u2014 combined with insufficient output escaping in generate_preview(), which injects those stored values into notification template HTML via str_replace() without any esc_html() call before echoing the result. This makes it possible for authenticated attackers with customer-level access or above to inject arbitrary web scripts into the admin notification preview panel that execute in an administrator’s or agent’s browser whenever a notification template referencing customer variables such as {{customer_full_name}}, {{customer_first_name}}, {{customer_last_name}}, {{customer_phone}}, or {{customer_notes}} is previewed.”,”published”:”2026-05-06T06:47:21.090Z”,”modified”:”2026-05-06T06:47:21.090Z”,”type”:”cve”,”title”:”LatePoint \\u003c= 5.5.0 – Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update”,”source”:”Wordfence”,”references”:”https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/id\/628b3f53-decd-47ac-a2d1-339ade1e6944?source=cve\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/latepoint\/trunk\/lib\/misc\/process_action.php#L606\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/latepoint\/tags\/5.5.0\/lib\/misc\/process_action.php#L606\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/latepoint\/trunk\/lib\/controllers\/customer_cabinet_controller.php#L318\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/latepoint\/tags\/5.5.0\/lib\/controllers\/customer_cabinet_controller.php#L318\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/latepoint\/trunk\/lib\/helpers\/replacer_helper.php#L276\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/latepoint\/tags\/5.5.0\/lib\/helpers\/replacer_helper.php#L276\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/latepoint\/tags\/5.3.1\/lib\/misc\/process_action.php#L606\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/latepoint\/tags\/5.3.1\/lib\/controllers\/customer_cabinet_controller.php#L318\\nhttps:\/\/plugins.trac.wordpress.org\/browser\/latepoint\/tags\/5.3.1\/lib\/helpers\/replacer_helper.php#L276\\nhttps:\/\/plugins.trac.wordpress.org\/changeset?sfp_email=\\u0026sfph_mail=\\u0026reponame=\\u0026new=3522933%40latepoint%2Ftrunk\\u0026old=3516282%40latepoint%2Ftrunk\\u0026sfp_email=\\u0026sfph_mail=”,”id”:”CVE-2026-7457″,”bulletinFamily”:””,”cwe”:[“CWE-79″],”cvelist”:null,”sourceData”:”latepoint LatePoint \u2013 Calendar Booking Plugin for Appointments and Events 0″,”sourceHref”:””,”cvss”:{“score”:6.4,”severity”:”MEDIUM”,”vector”:”CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:C\/C:L\/I:L\/A:N”,”version”:”3.1″},”cvss2″:{},”cvss3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””,”cvssV3″:{“version”:””,”vectorString”:””,”baseScore”:0,”baseSeverity”:””,”attackVector”:””,”attackComplexity”:””,”privilegesRequired”:””,”userInteraction”:””,”scope”:””,”confidentialityImpact”:””,”integrityImpact”:””,”availabilityImpact”:””}},”href”:””,”category_name”:”CVE”,”post_link”:””,”product”:”LatePoint \u2013 Calendar Booking Plugin for Appointments and Events”,”version”:”0″,”vendor”:”latepoint”,”ai_description”:””,”ai_severity”:””,”ai_vendor”:””,”ai_product”:””,”ai_version”:””,”ai_score”:0}<\/p>\n","protected":false},"excerpt":{"rendered":"
{“lastseen”:””,”description”:”The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.5.0. This is due to insufficient input…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[2],"tags":[6,8,46,12,21,13,7,11,5],"class_list":["post-51658","post","type-post","status-publish","format-standard","hentry","category-category_cve","tag-cve","tag-cvss","tag-cvss-64","tag-exploit","tag-medium","tag-news","tag-security","tag-tapic","tag-vulnerability"],"yoast_head":"\n