Pending AnalysisCVE-2026-7332

CVE-2026-7332: XSS in LatePoint Calendar Booking Plugin

Platform

wordpress

Component

latepoint

Fixed in

5.5.1

CVE-2026-7332 describes a Stored Cross-Site Scripting (XSS) vulnerability discovered in the LatePoint – Calendar Booking Plugin for Appointments and Events WordPress plugin. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially compromising user accounts and website functionality. The issue affects versions of the plugin up to and including 5.5.0, and a patch is available in version 5.5.1.

WordPress

Detect this CVE in your project

Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.

Impact and Attack Scenarios

Successful exploitation of CVE-2026-7332 allows an attacker to inject malicious JavaScript code into pages accessible through the LatePoint plugin. When a user visits an affected page, the injected script executes within their browser context, granting the attacker the ability to steal cookies, redirect users to phishing sites, or deface the website. The stored nature of the vulnerability means the malicious script persists until the affected parameter is properly sanitized, allowing for repeated exploitation. This could lead to widespread compromise of user data and website integrity, similar to other XSS attacks targeting WordPress plugins.

Exploitation Context

CVE-2026-7332 was published on May 5, 2026. Its severity is rated HIGH with a CVSS score of 7.2. There is no indication of this vulnerability being actively exploited in the wild or listed on KEV. Public proof-of-concept (POC) code is not currently available, but the vulnerability's nature makes it likely that a POC will be developed and shared publicly.

Threat Intelligence

Exploit Status

Proof of ConceptUnknown
CISA KEVNO
Internet ExposureHigh
Reports2 threat reports

EPSS

0.21% (44% percentile)

CISA SSVC

Exploitationnone
Automatableyes
Technical Impactpartial

CVSS Vector

THREAT INTELLIGENCE· CVSS 3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N7.2HIGHAttack VectorNetworkHow the attacker reaches the targetAttack ComplexityLowConditions required to exploitPrivileges RequiredNoneAuthentication level needed to attackUser InteractionNoneWhether a victim must take actionScopeChangedImpact beyond the vulnerable componentConfidentialityLowRisk of sensitive data exposureIntegrityLowRisk of unauthorized data modificationAvailabilityNoneRisk of service disruptionnextguardhq.com · CVSS v3.1 Base Score
What do these metrics mean?
Attack Vector
Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
Attack Complexity
Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
Privileges Required
None — unauthenticated. No login or credentials needed to exploit.
User Interaction
None — attack is automatic and silent. Victim does nothing: no click, no file open.
Scope
Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
Confidentiality
Low — partial or indirect data access. Attacker gains limited information.
Integrity
Low — attacker can modify some data with limited scope or impact.
Availability
None — no availability impact. Service remains fully operational.

Affected Software

Componentlatepoint
Vendorwordfence
Maximum version5.5.0
Fixed in5.5.1

Weakness Classification (CWE)

Timeline

  1. Reserved
  2. Published
  3. Modified
  4. EPSS updated

Mitigation and Workarounds

The primary mitigation for CVE-2026-7332 is to immediately upgrade the LatePoint – Calendar Booking Plugin to version 5.5.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters in the 'bookingformpageurl' parameter. Additionally, review and sanitize any user-supplied input used in constructing URLs within the plugin. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload through the 'bookingformpageurl' parameter and verifying that it does not execute.

How to fix

Update to version 5.5.1, or a newer patched version

Frequently asked questions

What is CVE-2026-7332 — XSS in LatePoint Calendar Booking Plugin?

CVE-2026-7332 is a Stored Cross-Site Scripting (XSS) vulnerability in the LatePoint plugin for WordPress, allowing attackers to inject malicious scripts via the 'bookingformpage_url' parameter. It impacts versions up to 5.5.0 and carries a HIGH severity rating.

Am I affected by CVE-2026-7332 in LatePoint Calendar Booking Plugin?

You are affected if your WordPress website uses the LatePoint plugin and is running version 5.5.0 or earlier. Check your plugin version immediately using wp plugin list.

How do I fix CVE-2026-7332 in LatePoint Calendar Booking Plugin?

Upgrade the LatePoint plugin to version 5.5.1 or later. If immediate upgrade isn't possible, consider a WAF rule to filter suspicious URL parameters as a temporary mitigation.

Is CVE-2026-7332 being actively exploited?

There is currently no public evidence of CVE-2026-7332 being actively exploited in the wild, but the vulnerability's nature makes it a potential target.

Where can I find the official LatePoint advisory for CVE-2026-7332?

Refer to the official LatePoint plugin website or WordPress plugin repository for the latest advisory and update information regarding CVE-2026-7332.

Is your project affected?

Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.

WordPress

Detect this CVE in your project

Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.

livefree scan

Scan your WordPress project now — no account

Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.

Manual scanSlack/email alertsContinuous monitoringWhite-label reports

Drag & drop your dependency file

composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...