The LatePoint Calendar Booking Plugin for WordPress suffers from a stored XSS vulnerability (CWE-79) via the 'booking_form_page_url' parameter due to improper input neutralization during web page generation. This flaw allows unauthenticated attackers to inject malicious JavaScript that is stored in the database and executed in users' browsers upon visiting the injected page. The issue exists in all plugin versions up to 5.5.0. The vulnerability is exploitable even without a fully functional Stripe integration because the relevant action hook fires prior to Stripe Connect account ID validation, enabling the attacker's payload to be logged and persist.

Successful exploitation can lead to execution of arbitrary scripts in the context of users visiting the affected pages, potentially resulting in session hijacking, defacement, or other malicious actions impacting confidentiality and integrity. The CVSS v3.1 base score is 7.2 (high severity), reflecting network attack vector, no privileges or user interaction required, and partial impact on confidentiality and integrity. Availability is not affected. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch link is provided in the available data. Until a patch is released, users should consider disabling or restricting access to the vulnerable parameter or plugin functionality if possible. Monitor vendor channels for updates and apply official patches promptly once available.