CVE-2026-7448: WordPress LatePoint Plugin Open to Unauthenticated Stored XSS
The National Vulnerability Database (NVD) has identified a critical vulnerability, CVE-2026-7448, affecting the LatePoint WordPress plugin. This booking and appointment plugin, in all versions up to and including 5.5.0, suffers from insufficient input sanitization and output escaping within the ‘first_name’ parameter. This flaw allows unauthenticated attackers to inject malicious scripts that will execute when any user visits a compromised page.
The CVSS score of 7.2 (HIGH) underscores the severity of this stored cross-site scripting (XSS) vulnerability. Attackers can leverage this weakness to execute arbitrary JavaScript in the context of a victim’s browser session. For organizations relying on the LatePoint plugin, this presents a significant risk of session hijacking, credential theft, or further site compromise through injected malicious content.
Defenders must prioritize updating the LatePoint plugin to a patched version immediately. Given the unauthenticated nature of the attack vector, any WordPress site running an affected version is exposed. Auditing for suspicious script injections and reviewing user session activity are crucial immediate steps for hardening defenses against this threat.
What This Means For You
- If your organization uses the LatePoint plugin on WordPress, patch it to version 5.5.1 or later immediately. Audit logs for any unusual script injections or user activity, especially focusing on pages where customer booking information might be displayed.
Related ATT&CK Techniques
🛡️ Detection Rules
2 rules · 6 SIEM formats2 detection rules auto-generated for this incident, mapped to MITRE ATT&CK. Sigma YAML is free — export to any SIEM format via the Intel Bot.
CVE-2026-7448: WordPress LatePoint Plugin Unauthenticated Stored XSS via first_name
title: CVE-2026-7448: WordPress LatePoint Plugin Unauthenticated Stored XSS via first_name
id: scw-2026-05-06-ai-1
status: experimental
level: high
description: |
Detects attempts to exploit CVE-2026-7448 by sending a POST request to wp-admin/admin-ajax.php with the action 'latepoint_save_booking_details' and injecting a script tag within the 'first_name' parameter. This indicates an attempt to store a Cross-Site Scripting payload within the LatePoint plugin.
author: SCW Feed Engine (AI-generated)
date: 2026-05-06
references:
- https://shimiscyberworld.com/posts/nvd-CVE-2026-7448/
tags:
- attack.initial_access
- attack.t1190
logsource:
category: webserver
detection:
selection:
cs-uri|contains:
- '/wp-admin/admin-ajax.php'
cs-uri-query|contains:
- 'action=latepoint_save_booking_details'
cs-uri-query|contains:
- 'first_name='
cs-uri-query|contains:
- '<script>'
cs-method:
- 'POST'
condition: selection
falsepositives:
- Legitimate administrative activity
Source: Shimi's Cyber World · License & reuse
Indicators of Compromise
| ID | Type | Indicator |
|---|---|---|
| CVE-2026-7448 | XSS | LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress |
| CVE-2026-7448 | XSS | Versions up to, and including, 5.5.0 |
| CVE-2026-7448 | XSS | Vulnerable parameter: 'first_name' |
| CVE-2026-7448 | XSS | Insufficient input sanitization and output escaping |
Written by SCW Vulnerability Desk
Source & Attribution
| Source Platform | NVD |
| Channel | National Vulnerability Database |
| Published | May 06, 2026 at 11:16 UTC |
This content was AI-rewritten and enriched by Shimi's Cyber World based on the original source. All intellectual property rights remain with the original author.
Believe this infringes your rights? Submit a takedown request.
Related coverage
CVE-2026-40001 — Code Execution
CVE-2026-40001 — There is a local privilege escalation vulnerability in the ZTE PROCESS Guard service of the cloud computer client, which may allow local arbitrary...
CVE-2026-35255 — The Oracle Cloud Native Environment Command Line Interface P Vulnerability
CVE-2026-35255 — Vulnerability in the Oracle Cloud Native Environment Command Line Interface product of Oracle Open Source Projects. The supported versions that is affected is v2.3.2. Easily...
WordPress Gravity Bookings Plugin Vulnerable to SQL Injection (CVE-2026-1719)
CVE-2026-1719 — The Gravity Bookings Premium plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 2.5.9 due to insufficient...