WordPress Plugin Vulnerabilities

LatePoint < 5.5.1 - Unauthenticated Stored Cross-Site Scripting via 'first_name' Parameter

Description

The plugin is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter due to insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affects Plugins

Plugin icon
latepoint
Fixed in 5.5.1

References

CVE
CVE-2026-7448
URL
https://www.wordfence.com/threat-intel/vulnerabilities/id/c8eedec9-d8d4-4052-baec-29f83ac306ac

Classification

Type
XSS
OWASP top 10
A7: Cross-Site Scripting (XSS)
CWE
CWE-79
CVSS
7.2 (high)

Miscellaneous

Original Researcher
AmonRa
Verified
No
WPVDB ID
e3c98f53-ef4f-4495-9a05-46ea7298ae93

Timeline

Publicly Published
2026-05-05 (about 8 days ago)
Added
2026-05-06 (about 7 days ago)
Last Updated
2026-05-06 (about 7 days ago)

Other

Published
Title
Published
2024-08-01
Title
Element Pack Elementor Addons < 5.6.12 - Contributor+ Stored XSS
Published
2024-11-01
Title
Header Footer Composer for Elementor <= 1.0.4 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2025-09-03
Title
Event Feed for Eventbrite < 1.4.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-11-13
Title
WP Githuber MD <= 1.16.3 - Authenticated (Contributor+) Stored Cross-Site Scripting
Published
2024-09-27
Title
Chartify < 2.7.7 - Reflected Cross-Site Scripting