CVE-2026-5391 in LatePoint Plugin
Summary
by MITRE • 08/06/2026
The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This makes it possible for authenticated attackers, with contributor level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 08/06/2026
The vulnerability identified in the LatePoint WordPress plugin represents a critical stored cross-site scripting flaw that undermines the security posture of affected websites. This issue manifests through the 'btn_wrapper_classes' attribute within the 'latepoint_resources' shortcode, where inadequate input validation and output escaping create exploitable conditions for malicious code injection. The vulnerability affects all versions up to and including 5.3.2, indicating a widespread exposure across numerous installations that have not received timely updates or patches. Security researchers have classified this as a stored XSS vulnerability due to the persistent nature of the attack vector, where injected scripts are stored on the server and executed whenever affected pages are accessed by unsuspecting users.
The technical exploitation of this vulnerability occurs within the 'locations' branch of the 'shortcode_latepoint_resources' function, which fails to properly sanitize user-supplied input before processing it for output. This failure in input sanitization creates an environment where authenticated attackers with contributor-level permissions or higher can craft malicious payloads that persistently reside within the plugin's shortcode processing logic. The vulnerability specifically targets the 'btn_wrapper_classes' attribute, which is likely used to customize button styling in the plugin's resource display functionality. When this attribute receives unfiltered input containing malicious script code, the insufficient output escaping allows the injected JavaScript to execute in the context of other users' browsers who view pages containing the compromised shortcode.
The operational impact of this vulnerability extends beyond simple script execution, as it enables attackers to leverage the privileges of authenticated users to perform actions that could compromise entire website operations. Contributors and higher-level users typically have access to various administrative functions within WordPress environments, making this vulnerability particularly dangerous when combined with user privilege escalation capabilities. The stored nature of the XSS attack means that once a malicious script is injected into the system, it will execute automatically whenever any user accesses pages containing the compromised shortcode, potentially leading to session hijacking, data theft, or further exploitation of the compromised environment. This persistent execution model significantly amplifies the damage potential compared to reflected XSS attacks that require specific user interaction.
Organizations affected by this vulnerability should immediately implement mitigation strategies including updating to the latest plugin version where available, implementing proper input validation measures, and conducting comprehensive security audits of their WordPress installations. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws in web applications, particularly emphasizing the importance of proper input sanitization and output escaping. From an ATT&CK framework perspective, this vulnerability maps to techniques involving command and control communications through compromised user accounts, as well as privilege escalation activities that could enable attackers to move laterally within compromised environments. Security teams should also consider implementing content security policies and regular monitoring of plugin directories for unauthorized modifications to prevent exploitation of similar vulnerabilities in other components of their WordPress infrastructure.
The broader implications of this vulnerability highlight the critical importance of maintaining current plugin versions and implementing robust security controls within WordPress environments. Organizations should establish automated patch management processes to ensure timely updates of all third-party components, as well as implement monitoring solutions that can detect anomalous behavior indicative of XSS attacks or other malicious activities. Additionally, access control measures should be reviewed to minimize the risk associated with users possessing contributor-level privileges, since this vulnerability specifically requires such access levels for exploitation to occur. Regular security assessments of WordPress plugins and themes remain essential defensive practices that can help identify similar vulnerabilities before they can be exploited by threat actors in the wild.