An unauthenticated Stored Cross-Site Scripting vulnerability in the LatePoint plugin for WordPress allows remote attackers to inject arbitrary web scripts into pages accessed by users.

This flaw involves improper neutralization of input during web generation, specifically CWE-79, affecting the booking_form_page_url parameter via unauthenticated access due to insufficient sanitization and escaping.

Successful exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary script code in the browser of users visiting the compromised pages. This can lead to unauthorized actions, session hijacking, or the theft of sensitive user data. The CVSS score of 7.2 places this issue in the high severity range, highlighting a substantial risk to web application integrity and user trust.

Immediate Action: Monitor the vendor advisory for a patched version release and update the LatePoint plugin immediately once available.

Proactive Monitoring: Review web server and application logs for anomalous parameter inputs targeting the booking_form_page_url parameter or suspicious script injections in database records.

Compensating Controls: Deploy a Web Application Firewall rule to inspect and block requests containing malicious script payloads targeting the vulnerable parameter.

Public Exploit Available: No — no confirmed public exploit or weaponized module is currently cataloged in available threat intelligence feeds.

Security teams must treat this high severity vulnerability with urgency, despite the current lack of a confirmed vendor patch or public exploit. Administrators should prepare to apply the update as soon as the vendor releases a fixed version, while utilizing Web Application Firewall rules to mitigate potential injection attempts in the interim.