VulnSocial

CVE-2026-4785Disclosure

LOWCVSS 6.4 · MEDIUM

Signal is active with 1 mentions in latest observed window

Immediate actions

  • Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' parameter in the [latepoint_resources] shortcode in versions up to and including 5.3.0. This is due to insufficient output escaping when the 'items' parameter is set to 'bundles'. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Back to dashboard
0.0/ 10 priority

Sources & remediation

Other references
Weakness type (CWE)
CWE-79

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Threat summary

  • 2 mentions across 2 observed days
  • Momentum state: stable

What's happening

  • Technical details provided in 2 signals
  • Disclosure: 2 classified signals
  • Peaked 1d ago at 1 mentions (2026-04-08); latest day: 1
  • 2 total mentions across 2 days

Deep dive

Activity timeline2 mentions / 2d
00111Mentions · 2026-04-08: 1Mentions · 2026-04-13: 1Technical Details · 2026-04-08: 1Technical Details · 2026-04-13: 104-0804-13
Signal classification1 categories
Disclosure
2100.0%
Referenced assets2 URLs
Full discourse2 posts
  • CVE@CVEnew
    Disclosure

    CVE-2026-4785 The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'button_caption' parameter… https://www.cve.org/CVERecord?id=CVE-2026-4785

    Post summary

    CVE-2026-4785 affects the LatePoint WordPress plugin, allowing stored XSS via the button_caption parameter; no PoC, exploit tools, active exploitation, or patch information is provided, but the technical details of the vulnerability are described.

    00000152
    57.1K followersView on X
  • Vulmon Vulnerability Feed@VulmonFeeds
    Disclosure

    CVE-2026-4785 Stored Cross-Site Scripting in LatePoint Calendar Booking Plugin for WordPress 5.3.0 https://vulmon.com/vulnerabilitydetails?qid=CVE-2026-4785

    Post summary

    CVE-2026-4785 is a stored cross‑site scripting vulnerability disclosed for the LatePoint Calendar Booking Plugin in WordPress 5.3.0.

    0000055
    4.0K followersView on X

Explore more

Back to dashboard