The LatePoint plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) in customer profile fields. Unsanitized input allows attackers to inject arbitrary web scripts that execute in the context of an administrator's browser when viewing customer activity history pages. This vulnerability affects all versions up to 5.2.5. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges required, no user interaction, and impacts on confidentiality and integrity with scope changed. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation allows unauthenticated attackers to execute arbitrary scripts in the administrator's browser context, potentially leading to theft of sensitive information, session hijacking, or other malicious actions performed with administrator privileges. The impact affects confidentiality and integrity but does not affect availability. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when viewing customer profile data and consider restricting access to the affected plugin's administrative interfaces. Monitoring for suspicious input in customer profile fields may help detect attempted exploitation.