PT-2026-37351 · WordPress · Latepoint

Ly Hoang · Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-7332

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.5.1

Description The plugin is susceptible to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping within the booking form page url parameter. Unauthenticated attackers can inject arbitrary web scripts into pages, which then execute when a user accesses them. The issue persists even without a configured Stripe integration because the latepoint order intent created action hook triggers before the Stripe Connect account ID is validated, allowing the malicious activity log entry to be written to the database.

Recommendations Update the plugin to a version later than 5.5.0.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7332

Affected Products

Latepoint

References · 15

• https://nvd.nist.gov/vuln/detail/CVE-2026-7332 · Security Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/stripe_connect_controller.php#L260 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c03ddcf0-6955-4645-b311-c3833ca61455?source=cve · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.1/lib/controllers/activities_controller.php#L214 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.1/lib/controllers/stripe_connect_controller.php#L260 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.4.1/lib/helpers/activities_helper.php#L83 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/activities_controller.php#L214 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/activities_helper.php#L83 · Note
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3522933%40latepoint%2Ftrunk&old=3516282%40latepoint%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/activities_helper.php#L83 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/activities_controller.php#L214 · Note
• https://t.me/CVEtracker/52821 · Telegram Post
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/stripe_connect_controller.php#L260 · Note
• https://twitter.com/VulmonFeeds/status/2051946431364121049 · Twitter Post
• https://twitter.com/KaitanSecurity/status/2051942552014577784 · Twitter Post