Description

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-08-06T12:16:27.603Z",
  "pubdate": "2026-08-06T12:16:27.603Z",
  "executiveSummary": "A Stored Cross-Site Scripting (XSS) vulnerability has been identified in the LatePoint plugin for WordPress in all versions up to, and including, 5.3.2. This security flaw resides within the 'locations' branch of the 'shortcode_latepoint_resources' function, specifically failing to adequately sanitize and escape the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode.\nThe vulnerability allows authenticated attackers, possessing contributor-level access and above, to inject arbitrary web scripts into pages. When an unsuspecting user accesses an injected page, the malicious script executes within the context of their browser session, leading to potential session hijacking, credential theft, or unauthorized actions performed on behalf of the victim.\nThe risk implication is moderate to high depending on the privileges of the targeted users viewing the rendered payload. Exploitation requires authenticated access with at least contributor permissions, enabling the insertion of the malicious shortcode into accessible post or page content.",
  "technicalDetails": "The vulnerability is caused by insufficient input sanitization and output escaping mechanisms implemented within the LatePoint plugin. Specifically, the 'shortcode_latepoint_resources' function processes user-supplied input through the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode without properly neutralizing HTML and JavaScript context markers.\nThe affected component is the 'locations' branch of the 'shortcode_latepoint_resources' function in the LatePoint plugin. All versions up to, and including, 5.3.2 are impacted by this flaw. The attack vector is local to the WordPress application context, requiring network exposure via the standard HTTP/HTTPS protocols used to interact with the WordPress front-end and back-end interfaces.\nExploitation requires authenticated access with contributor-level privileges or higher. An attacker leverages these privileges to create or edit a post, page, or any other content type that supports shortcodes. By inserting the 'latepoint_resources' shortcode and supplying a malicious payload within the 'btn_wrapper_classes' attribute—such as event handlers or script tags—the attacker successfully stores the arbitrary script directly into the database.\nOnce the payload is persisted, the attack flow proceeds when a victim accesses the affected page. The server processes the shortcode and renders the unsanitized input directly into the Document Object Model (DOM) of the HTTP response. The browser subsequently executes the injected script when parsing the page content. The post-exploitation impact includes the execution of arbitrary JavaScript in the victim's browser, potentially leading to administrative session compromise if a higher-privileged user views the payload."
}