Threats tagged 'ghsa-97wr-3wr5-r6wx'

The LatePoint Calendar Booking Plugin for WordPress versions up to and including 5.5.0 contains a stored cross-site scripting (XSS) vulnerability via the 'booking_form_page_url' parameter. This flaw allows unauthenticated attackers to inject malicious scripts that execute when users access the affected pages. The vulnerability arises from insufficient input sanitization and output escaping. Exploitation does not require a fully configured Stripe integration due to the order intent action hook firing before Stripe account validation.