CVE-2026-5391 is a stored cross-site scripting vulnerability in the LatePoint Appointment Booking Plugin for WordPress. The issue arises from insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function, specifically related to the 'btn_wrapper_classes' attribute. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary JavaScript that executes in the context of users visiting the injected pages. The vulnerability affects all versions up to and including 5.3.2.

An attacker with contributor-level access or higher can inject malicious scripts into pages via the vulnerable shortcode attribute. This can lead to execution of arbitrary JavaScript in the context of other users, potentially resulting in session hijacking, privilege escalation, or other malicious actions. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict contributor-level access to trusted users only and consider disabling or limiting use of the affected shortcode. Monitor official LatePoint channels for updates or patches addressing this vulnerability.