Threats tagged 'ghsa-2fmj-2rx7-3m6c'

The Appointment Booking Plugin – LatePoint for WordPress versions up to and including 5.7.6 is vulnerable to stored cross-site scripting (XSS) via the 'customer[email]' parameter. This vulnerability arises from insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject malicious scripts. Attackers can exploit this by registering as a customer through the public booking form using a crafted email address that passes validation but contains an HTML payload. The injected scripts execute whenever a user accesses the affected page, potentially compromising user interactions.