The LatePoint WordPress plugin for calendar booking is vulnerable to stored XSS via the 'first_name' parameter. This occurs because input is not properly neutralized during web page generation, allowing injection of arbitrary scripts. The vulnerability affects all plugin versions up to 5.5.0. The CVSS 3.1 base score is 7.2, reflecting network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope change. No patch or official fix has been published yet, and the plugin is not a cloud service, so remediation depends on vendor updates or user action.

An unauthenticated attacker can inject persistent malicious scripts via the 'first_name' parameter, which execute in the context of users viewing the affected pages. This can lead to theft of sensitive information, session hijacking, or other malicious actions impacting confidentiality and integrity. Availability is not affected. The vulnerability has a high severity rating (CVSS 7.2). There are no known active exploits reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should consider disabling or restricting access to the vulnerable plugin or applying manual input sanitization workarounds if feasible. Monitoring vendor channels for updates is recommended.