Threats tagged 'ghsa-hg94-gfmw-xvqm'

The LatePoint Appointment Booking Plugin for WordPress contains a stored cross-site scripting (XSS) vulnerability in the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. This vulnerability affects all versions up to and including 5.3.2 and allows authenticated users with contributor-level access or higher to inject arbitrary scripts that execute when a page is viewed. The issue arises from insufficient input sanitization and output escaping in the 'locations' branch of the shortcode processing function.