High · published February 3, 2026
⚡ A sneaky Stored XSS vulnerability in the LatePoint Calendar Booking Plugin is open for business! 🚀 Unauthenticated attackers can stealthily inject scripts through customer profile fields in any version up to 5.2.5. Think of it like a restaurant customer slipping a note into the server's order book — but instead of a simple message, it’s a mischievous prank that goes off when the chef reviews past orders. The next time the admin checks the customer's history, they get a surprise they didn't order! This could lead to absolutely devastating consequences, allowing attackers to run arbitrary scripts in the admin's browser. An attacker could steal sensitive session cookies, redirect administrators to malicious sites, or even perform actions on behalf of the administrator—effectively hijacking their session!
Think of it like a restaurant customer slipping a note into the server's order book — but instead of a simple message, it’s a mischievous prank that goes off when the chef reviews past orders. The next time the admin checks the customer's history, they get a surprise they didn't order! This vulnerability arises from insufficient input sanitization and output escaping in the customer profile fields, allowing attackers to inject malicious web scripts that execute when an admin views a customer's activity history.
This could lead to absolutely devastating consequences, allowing attackers to run arbitrary scripts in the admin's browser. An attacker could steal sensitive session cookies, redirect administrators to malicious sites, or even perform actions on behalf of the administrator—effectively hijacking their session! To protect your site, upgrade the LatePoint plugin to version 5.2.6 or later immediately. In addition, review and sanitize all user input fields to prevent future vulnerabilities. Regularly audit your plugins for any security updates! You've got this! Implement these fixes, and you'll have your WordPress site secured like a pro! 🛡️