Security readout for executives and security teams
Plain-English summary
CVE-2026-0617 affects the LatePoint WordPress booking plugin through version 5.2.5. A person who is not logged in could place malicious script content into customer profile fields. That script can later run in an administrator’s browser when they view customer activity history, creating risk to site administration sessions and stored data.
Executive priority
Treat as a high-priority WordPress plugin issue. It can target administrators through normal booking workflows and may affect site control. Prioritize inventory and updates on public-facing booking sites.
Technical view
This is unauthenticated stored cross-site scripting in LatePoint customer profile fields, caused by insufficient input sanitization and output escaping. The CVSS 3.1 score is 7.2. The script executes when an administrator views the customer activity history. Sources cite affected versions up to and including 5.2.5 and reference WordPress plugin code and a later changeset.
Likely exposure
WordPress sites using LatePoint – Calendar Booking Plugin for Appointments and Events version 5.2.5 or earlier are potentially exposed, especially if public booking or customer profile input is enabled.
Exploitation context
The attacker does not need authentication. Successful impact depends on an administrator viewing the affected customer activity history. The provided sources and KEV status do not show active exploitation.
Researcher notes
Evidence identifies stored XSS in customer profile fields reaching administrator activity history views. Public sources include code references and a WordPress plugin changeset, but the bundle does not clearly name a fixed release version.
Mitigation direction
- Identify all WordPress sites running LatePoint.
- Update LatePoint to a release newer than 5.2.5 if available.
- Review vendor and Wordfence guidance for the confirmed fixed version.
- Restrict unnecessary public booking/profile input until updated.
- Limit administrator access to activity history on unpatched sites.
Validation and detection
- Check installed LatePoint plugin versions across WordPress assets.
- Flag any LatePoint version 5.2.5 or earlier.
- Review customer profile and activity records for suspicious script-like content.
- Confirm the plugin is updated beyond the affected range.
- Verify administrator activity pages render untrusted fields safely after update.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-79: User-session and phishing behavior lookup
Client-side and session-facing weaknesses should be reviewed alongside initial-access and user-execution behaviors. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2026-0617 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- High
- CVSS
- 7.2 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N3.92.7Primary CVE scoreVulnerability scoring details
Base CVSS 3.1 score
7.2HighVector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Source materials
- CVE List V5 sourceCVE List V5
- https://www.wordfence.com/threat-intel/vulnerabilities/id/22bcfd36-ecf9-4d2c-ac94-94ffa0340c4c?source=cveCVE reference
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.5/lib/views/activities/view.php#L27CVE reference
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.5/lib/controllers/activities_controller.phpCVE reference
- https://plugins.trac.wordpress.org/browser/latepoint/tags/5.2.5/lib/models/activity_model.phpCVE reference
- https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3449263%40latepoint%2Ftrunk&old=3408660%40latepoint%2Ftrunk&sfp_email=&sfph_mail=CVE reference
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.