CVE-2026-7332: XSS in LatePoint Calendar Booking Plugin
Platform
wordpress
Component
latepoint
Fixed in
5.5.1
CVE-2026-7332 describes a Stored Cross-Site Scripting (XSS) vulnerability discovered in the LatePoint – Calendar Booking Plugin for Appointments and Events WordPress plugin. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially compromising user accounts and website functionality. The issue affects versions of the plugin up to and including 5.5.0, and a patch is available in version 5.5.1.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Impact and Attack Scenarios
Successful exploitation of CVE-2026-7332 allows an attacker to inject malicious JavaScript code into pages accessible through the LatePoint plugin. When a user visits an affected page, the injected script executes within their browser context, granting the attacker the ability to steal cookies, redirect users to phishing sites, or deface the website. The stored nature of the vulnerability means the malicious script persists until the affected parameter is properly sanitized, allowing for repeated exploitation. This could lead to widespread compromise of user data and website integrity, similar to other XSS attacks targeting WordPress plugins.
Exploitation Context
CVE-2026-7332 was published on May 5, 2026. Its severity is rated HIGH with a CVSS score of 7.2. There is no indication of this vulnerability being actively exploited in the wild or listed on KEV. Public proof-of-concept (POC) code is not currently available, but the vulnerability's nature makes it likely that a POC will be developed and shared publicly.
Threat Intelligence
Exploit Status
EPSS
0.21% (44% percentile)
CISA SSVC
CVSS Vector
What do these metrics mean?
- Attack Vector
- Network — remotely exploitable over the internet. No physical or local access required. Widest attack surface.
- Attack Complexity
- Low — no special conditions required. Attacker can exploit reliably without depending on rare configurations or timing.
- Privileges Required
- None — unauthenticated. No login or credentials needed to exploit.
- User Interaction
- None — attack is automatic and silent. Victim does nothing: no click, no file open.
- Scope
- Changed — successful attack can pivot beyond the vulnerable component to other systems or the host OS.
- Confidentiality
- Low — partial or indirect data access. Attacker gains limited information.
- Integrity
- Low — attacker can modify some data with limited scope or impact.
- Availability
- None — no availability impact. Service remains fully operational.
Affected Software
Weakness Classification (CWE)
Timeline
- Reserved
- Published
- Modified
- EPSS updated
Mitigation and Workarounds
The primary mitigation for CVE-2026-7332 is to immediately upgrade the LatePoint – Calendar Booking Plugin to version 5.5.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters in the 'bookingformpageurl' parameter. Additionally, review and sanitize any user-supplied input used in constructing URLs within the plugin. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload through the 'bookingformpageurl' parameter and verifying that it does not execute.
How to fix
Update to version 5.5.1, or a newer patched version
Frequently asked questions
What is CVE-2026-7332 — XSS in LatePoint Calendar Booking Plugin?
CVE-2026-7332 is a Stored Cross-Site Scripting (XSS) vulnerability in the LatePoint plugin for WordPress, allowing attackers to inject malicious scripts via the 'bookingformpage_url' parameter. It impacts versions up to 5.5.0 and carries a HIGH severity rating.
Am I affected by CVE-2026-7332 in LatePoint Calendar Booking Plugin?
You are affected if your WordPress website uses the LatePoint plugin and is running version 5.5.0 or earlier. Check your plugin version immediately using wp plugin list.
How do I fix CVE-2026-7332 in LatePoint Calendar Booking Plugin?
Upgrade the LatePoint plugin to version 5.5.1 or later. If immediate upgrade isn't possible, consider a WAF rule to filter suspicious URL parameters as a temporary mitigation.
Is CVE-2026-7332 being actively exploited?
There is currently no public evidence of CVE-2026-7332 being actively exploited in the wild, but the vulnerability's nature makes it a potential target.
Where can I find the official LatePoint advisory for CVE-2026-7332?
Refer to the official LatePoint plugin website or WordPress plugin repository for the latest advisory and update information regarding CVE-2026-7332.
Is your project affected?
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Detect this CVE in your project
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Scan your WordPress project now — no account
Upload any manifest (composer.lock, package-lock.json, WordPress plugin list…) or paste your component list. You get a vulnerability report instantly. Uploading a file is just the start: with an account you get continuous monitoring, Slack/email alerts, multi-project and white-label reports.
Drag & drop your dependency file
composer.lock, package-lock.json, requirements.txt, Gemfile.lock, pubspec.lock, Dockerfile...