Platform
wordpress
Component
latepoint
Fixed in
5.2.8
CVE-2026-2324 describes a Cross-Site Scripting (XSS) vulnerability discovered in the LatePoint – Calendar Booking Plugin for Appointments and Events WordPress plugin. This vulnerability allows unauthenticated attackers to inject malicious web scripts by exploiting insufficient nonce validation within the reload_preview() function. The vulnerability impacts versions 0.0.0 through 5.2.7, and a patch is available in version 5.2.8.
Successful exploitation of CVE-2026-2324 could allow an attacker to execute arbitrary JavaScript code within the context of a user's browser, specifically targeting site administrators. This could lead to account takeover, data theft (including sensitive appointment details and user information), and defacement of the WordPress site. The attack relies on tricking an administrator into clicking a malicious link, making social engineering a key component. While the vulnerability requires administrator interaction, the potential impact is significant, as it could compromise the entire WordPress site and its associated data.
CVE-2026-2324 was publicly disclosed on 2026-03-11. No public proof-of-concept (POC) code has been released at the time of writing, but the vulnerability's nature makes it likely that a POC will emerge. The vulnerability is not currently listed on the CISA KEV catalog. Given the relatively straightforward nature of XSS exploitation, it is prudent to assume that this vulnerability could be targeted by opportunistic attackers.
Exploit Status
EPSS
0.01% (2% percentile)
CISA SSVC
CVSS Vector
The primary mitigation for CVE-2026-2324 is to immediately upgrade the LatePoint – Calendar Booking Plugin to version 5.2.8 or later. If upgrading is not immediately feasible, consider implementing stricter input validation and output encoding on all user-supplied data within the plugin. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can provide an additional layer of defense. Monitor WordPress logs for suspicious activity, particularly requests targeting the reload_preview() function. After upgrading, confirm the fix by attempting to trigger the vulnerable function with a known malicious payload and verifying that it is properly sanitized.
Update to version 5.2.8, or a newer patched version
Vulnerability analysis and critical alerts directly to your inbox.
CVE-2026-2324 is a Cross-Site Scripting (XSS) vulnerability affecting the LatePoint Calendar Booking Plugin for WordPress, allowing attackers to inject malicious scripts. It impacts versions 0.0.0–5.2.7.
You are affected if your WordPress site uses the LatePoint Calendar Booking Plugin in versions 0.0.0 through 5.2.7. Upgrade to 5.2.8 to mitigate the risk.
Upgrade the LatePoint Calendar Booking Plugin to version 5.2.8 or later. Consider implementing stricter input validation and WAF rules as additional security measures.
While no active exploitation has been confirmed, the vulnerability's nature makes it a potential target for opportunistic attackers. Monitoring and proactive mitigation are recommended.
Refer to the official LatePoint website and WordPress plugin repository for the latest advisory and update information regarding CVE-2026-2324.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.
Upload your dependency file and we'll tell you instantly if this and other CVEs hit you.