CVE-2026-4785

Name of the Vulnerable Software and Affected Versions LatePoint – Calendar Booking Plugin for Appointments and Events versions up to and including 5.3.0

Description The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is susceptible to Stored Cross-Site Scripting through the button caption parameter within the [latepoint resources] shortcode. This occurs because of inadequate output escaping when the items parameter is set to 'bundles'. Authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which will then execute when a user accesses those pages.

Recommendations Update LatePoint – Calendar Booking Plugin for Appointments and Events to a version later than 5.3.0.