CVE-2026-105258
CVE-2026-105258 · LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
This page contains facts from public vulnerability sources. Check the original advisory before updating.
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
CVSS 3.5 · Low · EPSS 0.2% · Fix available
- Published
- Updated
Affected products and versions
appointment booking plugin
- Versions
- ≥ 0, < 5.7.6: Affected (semver)
Update to 5.7.6