CVE-2026-105258
LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
Unknown Appointment Booking Plugin
CVSS
NoneNot scoredExploitationNo known exploitationNot in CISA KEV, which does not prove it is unexploitedCISA KEV
Exploit odds (EPSS)No scoreNo FIRST EPSS score in this snapshot yet
What fixes it
- 5.7.6Appointment Booking PluginCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
Text from CVE List
Affected versions 1
- Appointment Booking Pluginaffected: all versions before 5.7.6CVE List