The LatePoint WordPress plugin up to version 5.5.0 contains a stored cross-site scripting (XSS) vulnerability. This occurs because certain customer profile fields are not properly sanitized before being stored and are later output without proper escaping in notification template previews. Authenticated users with customer-level access can inject malicious scripts that execute in administrator or agent browsers when previewing notifications referencing those customer fields.