Cyber Resilience

CVE-2026-7448

N/A

Published: 06 May 2026

Published
06 May 2026
Modified
08 May 2026
KEV Added
—
Patch
—
CVSS Score N/A
EPSS Score 0.0012 30.8th percentile
Risk Priority 0 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2026-7448 is a uncategorised-severity an unspecified weakness vulnerability. Its CVSS base score is N/A.

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 30.8th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-15 (Information Output Filtering).

Deeper analysis

CVE-2026-7448 is a stored cross-site scripting (XSS) vulnerability, classified under CWE-79, in the LatePoint – Calendar Booking Plugin for Appointments and Events for WordPress. It affects all versions up to and including 5.5.0 due to insufficient input sanitization and output escaping of the 'first_name' parameter. This flaw enables the injection of arbitrary web scripts into pages, with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N).

Unauthenticated attackers can exploit the vulnerability remotely with low attack complexity and no privileges or user interaction required. By submitting a crafted 'first_name' parameter, they can store malicious scripts on the server, which then execute in the context of any user's browser when accessing the injected page, potentially leading to low-level confidentiality and integrity impacts given the changed scope.

References provided link to vulnerable code locations in the plugin's source repository, including activities_controller.php (lines 270 in versions 5.3.2 and 5.5.0), email_helper.php (line 50 in 5.3.2), replacer_helper.php (line 276 in 5.3.2), and customer_model.php (line 376 in 5.3.2). No specific mitigation or patch details are detailed in the available references.

EU & UK References

Vulnerability details

Rejected reason: ** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. Reason: This candidate was issued in error. Notes: All references and descriptions in this candidate have been removed to prevent accidental usage.

CWE(s)
None listed

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
T1059.007 JavaScript Execution
Adversaries may abuse various implementations of JavaScript for execution.
attack.mitre.org →
T1185 Browser Session Hijacking Collection
Adversaries may take advantage of security vulnerabilities and inherent functionality in browser software to change content, modify user-behaviors, and intercept information as part of various browser session hijacking techniques.
attack.mitre.org →
T1539 Steal Web Session Cookie Credential Access
An adversary may steal web application or service session cookies and use them to gain access to web applications or Internet services as an authenticated user without needing credentials.
attack.mitre.org →
Why these techniques?

Stored XSS in public-facing WordPress plugin directly enables T1190 (exploiting the vulnerable booking endpoint with unsanitized first_name). Arbitrary script execution in victim browsers maps to T1059.007 (JavaScript interpreter), T1185 (browser session hijacking via injected scripts), and T1539 (stealing web session cookies).

Confidence: HIGH · MITRE ATT&CK Enterprise v18.1

Affected Assets

Mitigating Controls

Mitigating Controls (NIST 800-53 r5) AI

SI-10 Information Input Validation good match
prevent

Directly requires validation and sanitization of untrusted inputs such as the 'first_name' parameter before storage, eliminating the root cause of the stored XSS flaw.

SI-15 Information Output Filtering good match
prevent

Requires filtering/escaping of data on output (e.g., in activities_controller.php, email_helper.php, replacer_helper.php), preventing execution of stored malicious scripts in user browsers.

SI-3 Malicious Code Protection partial match
detectrespond

Enables detection and blocking of malicious script payloads injected via the vulnerable parameter through code inspection or runtime filtering.

References