CVE Database /
CVE-2026-7457
CVE · Medium
CVE-2026-7457 — Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] < 5.5.1
| CVE |
Vulnerability |
Type |
Severity |
Affected |
Fixed in |
Published |
Status |
|
CVE-2026-7457
|
Appointment Booking Plugin – LatePoint | Calendar & Scheduling for WordPress [latepoint] < 5.5.1 |
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
Medium
6.4
|
< 5.5.1
|
5.5.1 |
2026-05-05 |
—
|
CVE-2026-7457
A vulnerability exists in the LatePoint plugin for WordPress, specifically in versions up to 5.5.0, which allows an authenticated attacker with customer-level access or higher to inject malicious scripts into the admin notification preview panel. This is due to the plugin storing unsanitized user input in the database and then echoing it in notification templates without proper HTML escaping, enabling the injection of arbitrary web scripts that execute in the administrator's or agent's browser when a notification template referencing customer variables is previewed.
Based on public CVE data (MITRE/NVD).
Scan your WordPress site free
No signup, no credit card — enter your URL and get a security report in seconds.
See the full security page for this plugin
Browse the CVE database
Browse all security findings