{"id":"CVE-2026-105258","title":"LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings","summary":"The Appointment Booking Plugin  WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject Jav…","severity":"low","cvss":3.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N","cvssSource":"adp","cwe":["CWE-79"],"product":"Appointment Booking Plugin","affected":["appointment_booking_plugin < 5.7.6"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-10-29T10:51:26.341127Z"},"published":"2026-10-29","updated":"2026-10-29","sourceUpdated":"2026-10-29T10:56:07.796Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-105258","references":[{"url":"https://wpscan.com/vulnerability/134c2bda-aa25-4c79-b2b0-171b17e18591/"}],"tags":["cve.org"],"epss":0.00173,"epssPercentile":0.06762,"ingestedAt":"2026-11-01T17:57:46.222Z","slug":"CVE-2026-105258","body":"## Overview\n\nThe Appointment Booking Plugin  WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.\n\n## Affected\n\n- `appointment_booking_plugin < 5.7.6`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":19,"depthScoreParts":{"impact":19.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}