An authenticated Stored Cross-Site Scripting vulnerability in the LatePoint plugin for WordPress allows attackers to execute malicious scripts via the first_name parameter.

This is a Stored Cross-Site Scripting vulnerability residing in the first_name parameter, requiring authenticated access to successfully inject malicious scripts.

A successful exploit could allow malicious actors to execute arbitrary script code in the context of a user session, potentially leading to unauthorized actions or session hijacking. Given the CVSS score of 7.2, this vulnerability represents a high severity risk that requires prompt attention to maintain application integrity and user trust.

Immediate Action: Review the WordPress environment and disable or restrict the LatePoint plugin until a secure vendor update is released.

Proactive Monitoring: Monitor application logs for anomalous parameter submissions and unusual administrative or user profile modifications.

Compensating Controls: Deploy Web Application Firewall rules to detect and block suspicious cross-site scripting payloads targeting input fields.

Public Exploit Available: exploit_available (false / unknown)

Given the high severity rating of this vulnerability, administrators should prioritize mitigation by restricting plugin usage. Applying available updates from the vendor as soon as they are published remains critical to preventing potential exploitation.