WordPress Plugin Vulnerabilities

LatePoint < 5.2.6 - Unauthenticated Stored XSS

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the customer profile fields due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the customer's activity history.

Affects Plugins

Plugin icon
latepoint
Fixed in 5.2.6

References

CVE
CVE-2026-0617
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/22bcfd36-ecf9-4d2c-ac94-94ffa0340c4c

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.1 (high)

Miscellaneous

Original Researcher
w41bu1
Verified
No
WPVDB ID
81cad214-222a-40e0-996c-f893070ad700

Timeline

Publicly Published
2026-02-02 (about 3 months ago)
Added
2026-02-03 (about 3 months ago)
Last Updated
2026-02-03 (about 3 months ago)

Other

Published
Title
Published
2023-12-25
Title
Estatik Real Estate Plugin < 4.1.1 - Reflected XSS
Published
2025-11-10
Title
Eventbee Ticketing Widget <= 1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-09-24
Title
Charity Addon for Elementor < 1.3.2 - Contributor+ Stored XSS
Published
2023-04-23
Title
AI Contact Us Form <= 1.0 - Admin+ Stored XSS
Published
2024-03-25
Title
WordPress Meta Data and Taxonomies Filter (MDTF) < 1.3.3 - Authenticated (Contributor+) Stored Cross-Site Scripting