CVE-2025-6815

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions through 5.1.94

Description The LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress is susceptible to Stored Cross-Site Scripting. The issue stems from inadequate input sanitization and output escaping in the service[name] parameter. This allows authenticated attackers with administrator-level access to inject arbitrary web scripts into pages. These scripts will execute when a user accesses the injected page. This only affects multi-site installations and installations where unfiltered html has been disabled.

Recommendations Update LatePoint – Calendar Booking Plugin for Appointments and Events to a version later than 5.1.94.