CVE-2026-7457: LatePoint <= 5.5.0 - Authenticated (Subscriber+) Stored Cross-Site Scripting via Customer Cabinet Profile Update

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to and including 5.5.0. This is due to insufficient input sanitization on the customer cabinet profile update endpoint — where raw POST parameters (firstname, lastname, phone, notes) bypass sanitization because OsCustomerModel does not override paramstosanitize(), causing setdata() to store unsanitized values verbatim in the database — combined with insufficient output escaping in generatepreview(), which injects those stored values into notification template HTML via strreplace() without any eschtml() call before echoing the result. This makes it possible for authenticated attackers with customer-level access or above to inject arbitrary web scripts into the admin notification preview panel that execute in an administrator's or agent's browser whenever a notification template referencing customer variables such as {{customerfullname}}, {{customerfirstname}}, {{customerlastname}}, {{customerphone}}, or {{customernotes}} is previewed.