CVE-2026-0617

High

Published: 03 February 2026

Published

03 February 2026

Modified

15 April 2026

KEV Added

—

Patch

—

CVSS Score v3.1 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N

EPSS Score 0.0007 22.5th percentile

Risk Priority 14 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-0617 is a high-severity Cross-site Scripting (CWE-79) vulnerability in Wordpress (inferred from references). Its CVSS base score is 7.2 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 22.5th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2026-0617 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, affecting the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress in all versions up to and including 5.2.5. The flaw stems from insufficient input sanitization and output escaping in customer profile fields, enabling the injection of arbitrary web scripts into pages. It carries a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N), highlighting its high severity due to network accessibility, low complexity, no required privileges or user interaction, and changed scope.

Unauthenticated attackers can exploit this vulnerability by submitting malicious scripts through customer profile fields, which are then stored persistently. The injected scripts execute in the context of an administrator's browser whenever they view the affected customer's activity history, potentially leading to session hijacking, data theft, or further site compromise.

Mitigation is addressed through patches in the WordPress plugin repository, as evidenced by the referenced changeset comparing revisions 3408660 and 3449263 in the LatePoint trunk, along with fixes in files like activities_controller.php, activity_model.php, and activities/view.php. Security advisories, such as the Wordfence threat intelligence report, recommend updating to a patched version beyond 5.2.5 to sanitize and escape inputs properly.

EU & UK References

🇪🇺 ENISA EUVD: EUVD-2026-5287

Vulnerability details

The LatePoint – Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customer profile fields in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping.…

This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever an administrator views the customer's activity history.

CWE(s): CWE-79

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access

Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.

attack.mitre.org →

T1059.007 JavaScript Execution

Adversaries may abuse various implementations of JavaScript for execution.

attack.mitre.org →

T1185 Browser Session Hijacking Collection

Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.

attack.mitre.org →

Why these techniques?

Stored XSS in public-facing WordPress plugin directly enables T1190 exploitation; injected JS payload maps to T1059.007 execution; results in browser session hijacking per T1185.

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1