CVE-2026-4785: LatePoint <= 5.3.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'buttoncaption' parameter in the [latepointresources] shortcode in versions up to and including 5.3.0. This is due to insufficient output escaping when the 'items' parameter is set to 'bundles'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress)to a version that resolves this vulnerability.Fixed in 5.3.0 - Compensating control
Mitigate until patched by avoiding use of the [latepoint_resources] shortcode with the 'button_caption' parameter when the plugin is configured such that the 'items' parameter is set to 'bundles'.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-4785?
CVE-2026-4785 is classified as a high severity vulnerability due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2026-4785?
To fix CVE-2026-4785, update the LatePoint plugin to version 5.3.1 or later where the vulnerability has been addressed.
Who is affected by CVE-2026-4785?
CVE-2026-4785 affects users of the LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress version 5.3.0 and earlier.
What type of exploitation is involved in CVE-2026-4785?
CVE-2026-4785 involves exploitation through authenticated stored cross-site scripting via the 'button_caption' parameter in the shortcode.
What are the potential impacts of CVE-2026-4785?
The potential impacts of CVE-2026-4785 include the execution of malicious scripts on users' browsers leading to data theft or session hijacking.