LatePoint < 5.5.1 - Unauthenticated Stored Cross-Site Scripting via 'booking_form_page_url' Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'booking_form_page_url' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The malicious activity log entry is written to the database even when Stripe is not configured, because the latepoint_order_intent_created action hook fires before the Stripe Connect account ID is validated, meaning a fully functional Stripe integration is not required for exploitation.