免费扫描
分析待定CVE-2026-7332

CVE-2026-7332: XSS in LatePoint Calendar Booking Plugin

平台

wordpress

组件

latepoint

修复版本

5.5.1

在NVD查看
保存

CVE-2026-7332 describes a Stored Cross-Site Scripting (XSS) vulnerability discovered in the LatePoint – Calendar Booking Plugin for Appointments and Events WordPress plugin. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially compromising user accounts and website functionality. The issue affects versions of the plugin up to and including 5.5.0, and a patch is available in version 5.5.1.

WordPress

检测此 CVE 是否影响你的项目

上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。

免费扫描

影响与攻击场景翻译中…

Successful exploitation of CVE-2026-7332 allows an attacker to inject malicious JavaScript code into pages accessible through the LatePoint plugin. When a user visits an affected page, the injected script executes within their browser context, granting the attacker the ability to steal cookies, redirect users to phishing sites, or deface the website. The stored nature of the vulnerability means the malicious script persists until the affected parameter is properly sanitized, allowing for repeated exploitation. This could lead to widespread compromise of user data and website integrity, similar to other XSS attacks targeting WordPress plugins.

利用背景翻译中…

CVE-2026-7332 was published on May 5, 2026. Its severity is rated HIGH with a CVSS score of 7.2. There is no indication of this vulnerability being actively exploited in the wild or listed on KEV. Public proof-of-concept (POC) code is not currently available, but the vulnerability's nature makes it likely that a POC will be developed and shared publicly.

威胁情报

漏洞利用状态

概念验证未知
CISA KEVNO
互联网暴露高
报告2 份威胁报告

EPSS

0.21% (44% 百分位)

CISA SSVC

利用情况none
可自动化yes
技术影响partial

CVSS 向量

威胁情报· CVSS 3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N7.2HIGHAttack VectorNetwork攻击者如何到达目标Attack ComplexityLow利用漏洞所需的条件Privileges RequiredNone攻击所需的认证级别User InteractionNone是否需要受害者采取行动ScopeChanged超出受影响组件的影响范围ConfidentialityLow敏感数据泄露风险IntegrityLow数据未授权篡改风险AvailabilityNone服务中断风险nextguardhq.com · CVSS v3.1 基础分数
这些指标意味着什么？
Attack Vector
网络 — 可通过互联网远程利用，无需物理或本地访问。攻击面最大。
Attack Complexity
低 — 无需特殊条件，可以稳定地利用漏洞。
Privileges Required
无 — 无需认证，无需凭证即可利用。
User Interaction
无 — 攻击自动且无声，受害者无需任何操作。
Scope
已改变 — 攻击可以超出脆弱组件，影响其他系统。
Confidentiality
低 — 可访问部分数据。
Integrity
低 — 攻击者可修改部分数据，影响有限。
Availability
无 — 无可用性影响。

受影响的软件

组件latepoint
供应商wordfence
最高版本5.5.0
修复版本5.5.1

弱点分类 (CWE)

CWE-79

时间线

  1. 已保留
  2. 发布日期
  3. 修改日期
  4. EPSS 更新日期

缓解措施和替代方案翻译中…

The primary mitigation for CVE-2026-7332 is to immediately upgrade the LatePoint – Calendar Booking Plugin to version 5.5.1 or later. If upgrading is not immediately feasible, consider implementing a Web Application Firewall (WAF) rule to filter requests containing suspicious characters in the 'bookingformpageurl' parameter. Additionally, review and sanitize any user-supplied input used in constructing URLs within the plugin. After upgrading, confirm the vulnerability is resolved by attempting to inject a simple JavaScript payload through the 'bookingformpageurl' parameter and verifying that it does not execute.

修复方法

更新至 5.5.1 版本，或更新的补丁版本

常见问题翻译中…

What is CVE-2026-7332 — XSS in LatePoint Calendar Booking Plugin?

CVE-2026-7332 is a Stored Cross-Site Scripting (XSS) vulnerability in the LatePoint plugin for WordPress, allowing attackers to inject malicious scripts via the 'bookingformpage_url' parameter. It impacts versions up to 5.5.0 and carries a HIGH severity rating.

Am I affected by CVE-2026-7332 in LatePoint Calendar Booking Plugin?

You are affected if your WordPress website uses the LatePoint plugin and is running version 5.5.0 or earlier. Check your plugin version immediately using wp plugin list.

How do I fix CVE-2026-7332 in LatePoint Calendar Booking Plugin?

Upgrade the LatePoint plugin to version 5.5.1 or later. If immediate upgrade isn't possible, consider a WAF rule to filter suspicious URL parameters as a temporary mitigation.

Is CVE-2026-7332 being actively exploited?

There is currently no public evidence of CVE-2026-7332 being actively exploited in the wild, but the vulnerability's nature makes it a potential target.

Where can I find the official LatePoint advisory for CVE-2026-7332?

Refer to the official LatePoint plugin website or WordPress plugin repository for the latest advisory and update information regarding CVE-2026-7332.

你的项目受影响吗?

上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。

免费扫描搜索 CVE
WordPress

检测此 CVE 是否影响你的项目

上传你的依赖文件，立即了解此CVE和其他CVE是否影响你。

免费扫描
live免费扫描

立即扫描您的WordPress项目 — 无需账户

上传任何清单文件 (composer.lock, package-lock.json, WordPress 插件列表…) 或粘贴您的组件列表。您立即获得一份漏洞报告。上传文件只是开始：拥有账户后，您将获得持续监控、Slack/电子邮件警报、多项目和白标报告。

手动扫描Slack/邮件提醒持续监控白标报告

拖放您的依赖文件

composer.lock、package-lock.json、requirements.txt、Gemfile.lock、pubspec.lock、Dockerfile...