---
id: CVE-2026-105258
title: LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
summary: >-
  The Appointment Booking Plugin  WordPress plugin before 5.7.6 does not escape
  several booking-form step content settings before rendering them on the public
  booking form, allowing high-privilege users such as administrators to inject
  Jav…
severity: low
cvss: 3.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N'
cvssSource: adp
cwe:
  - CWE-79
product: Appointment Booking Plugin
affected:
  - appointment_booking_plugin < 5.7.6
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-10-29T10:51:26.341127Z'
published: '2026-10-29'
updated: '2026-10-29'
sourceUpdated: '2026-10-29T10:56:07.796Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-105258'
references:
  - url: 'https://wpscan.com/vulnerability/134c2bda-aa25-4c79-b2b0-171b17e18591/'
tags:
  - cve.org
epss: 0.00173
epssPercentile: 0.06762
ingestedAt: '2026-11-01T17:57:46.222Z'
---

## Overview

The Appointment Booking Plugin  WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.

## Affected

- `appointment_booking_plugin < 5.7.6`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.