PT-2026-37352 · WordPress · Latepoint

Ramon Mateas · Published 2026-05-06 · Updated 2026-05-06 · CVE-2026-7448

Positive Technologies (AI Summary)

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions prior to 5.5.1

Description The plugin is susceptible to Stored Cross-Site Scripting (XSS), a flaw where malicious scripts are permanently stored on the target server. This occurs due to insufficient input sanitization and output escaping in the first name parameter. Unauthenticated attackers can inject arbitrary web scripts into pages, which then execute in the browser of any user who accesses the affected page.

Recommendations Update the plugin to a version later than 5.5.0. As a temporary workaround, restrict or sanitize the input received through the first name parameter to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-7448

Affected Products

Latepoint

References · 18

• https://nvd.nist.gov/vuln/detail/CVE-2026-7448 · Security Note
• https://t.me/CVEtracker/52822 · Telegram Post
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/replacer_helper.php#L276 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/helpers/email_helper.php#L50 · Note
• https://twitter.com/VulmonFeeds/status/2051951550986117322 · Twitter Post
• https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3522933%40latepoint%2Ftrunk&old=3516282%40latepoint%2Ftrunk&sfp_email=&sfph_mail= · Note
• https://twitter.com/KaitanSecurity/status/2051942561586016370 · Twitter Post
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/models/customer_model.php#L376 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/controllers/activities_controller.php#L270 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/trunk/lib/models/customer_model.php#L376 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/helpers/email_helper.php#L50 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.3.2/lib/helpers/replacer_helper.php#L276 · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.3.2/lib/models/customer_model.php#L376 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/c8eedec9-d8d4-4052-baec-29f83ac306ac?source=cve · Note
• https://plugins.trac.wordpress.org/browser/latepoint/tags/5.5.0/lib/controllers/activities_controller.php#L270 · Note