CVE-2026-5391 latepoint CVE debrief

Who should care

Users of the LatePoint plugin for WordPress, particularly those with contributor level access and above, should be aware of this vulnerability and take steps to mitigate it. This includes verifying installed versions, applying vendor remediation when available, monitoring for suspicious activity, restricting contributor level access and above, and implementing compensating controls. Security teams should review the vulnerability's impact on their platforms and prioritize remediation efforts accordingly. Vulnerability management processes should be updated to include checks for this vulnerability, and asset inventory should be reviewed to identify potentially affected systems. Security teams should also monitor for potential exploitation attempts and review logs for exposed assets that need extra review. Additionally, operators of WordPress platforms using the LatePoint plugin should ensure that their systems are up-to-date and patched against this vulnerability, and that compensating controls are in place to mitigate potential impacts. This vulnerability could have operational impacts on WordPress platforms using the LatePoint plugin, particularly if exploited by an attacker with contributor level access and above. Therefore, it is essential for security teams to prioritize remediation efforts and ensure that affected systems are properly patched and secured. The vulnerability's impact on security teams will depend on the specific systems and platforms affected, as well as the effectiveness of existing security controls and mitigation strategies. In general, security teams should be aware of the potential risks associated with this vulnerability and take proactive steps to mitigate them. This includes reviewing and updating vulnerability management processes, asset inventory, and security controls to ensure that they are effective in preventing or detecting potential exploitation attempts. By taking these steps, security teams can help minimize the potential impacts of this vulnerability and ensure the security and integrity of their systems and data. In terms of defensive priority, security teams should focus on verifying installed versions, applying vendor rem

Technical summary

The LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode in all versions up to, and including, 5.3.2. This is due to insufficient input sanitization and output escaping in the 'locations' branch of the 'shortcode_latepoint_resources' function. This vulnerability allows authenticated attackers with contributor level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Defensive priority

Authenticated attackers with contributor level access and above can inject web scripts due to insufficient input sanitization and output escaping in the LatePoint plugin for WordPress.

Recommended defensive actions

• Inventory and verify installed version of LatePoint plugin for WordPress
• Apply vendor remediation when available
• Monitor for suspicious activity
• Restrict contributor level access and above
• Implement compensating controls

Evidence notes

The CVE-2026-5391 record indicates that the LatePoint plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'btn_wrapper_classes' attribute of the 'latepoint_resources' shortcode. Evidence is based on CVE and NVD records, with references from Wordfence. The vulnerability allows authenticated attackers with contributor level access and above to inject web scripts due to insufficient input sanitization and output escaping. Defenders should verify installed versions, review vendor remediation guidance, and monitor for suspicious activity.

Official resources