CVE-2026-105258 LatePoint < 5.7.6 - Admin+ Stored XSS via Booking Form Step Settings
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-105258?
CVE-2026-105258 is a low-severity vulnerability in Unknown Appointment Booking Plugin, published on 29 Oct 2026.
Official description
The Appointment Booking Plugin WordPress plugin before 5.7.6 does not escape several booking-form step content settings before rendering them on the public booking form, allowing high-privilege users such as administrators to inject JavaScript that executes in the browser of any visitor who loads the form; on multisite, where administrators do not hold the unfiltered_html capability, this crosses a privilege boundary to unauthenticated visitors.
Weakness: CWE-79
Which versions are affected by CVE-2026-105258?
How do I fix CVE-2026-105258?
No fix has been published for CVE-2026-105258 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-105258 being exploited?
There is no known exploitation of CVE-2026-105258 in the wild and no public exploit code.
Sources
Also known as GHSA-ffw8-2wfv-h8fc.