CVE-2026-4785

OVERVIEW CVE-2026-4785 is a Stored Cross-Site Scripting vulnerability affecting the LatePoint Calendar Booking Plugin for WordPress through version 5.3.0. The flaw exists in the [latepoint_resources] shortcode's 'button_caption' parameter when the 'items' parameter is configured for 'bundles,' resulting from improper output escaping. Authenticated contributors and higher-privileged users can inject malicious scripts into pages, which execute for any visitor accessing the compromised content. SEVERITY The vulnerability carries a CVSS v3.1 score of 6.4 (Medium) with a network-based attack vector requiring low complexity and low privileges to exploit, with no user interaction needed. The impact scope is changed, affecting confidentiality and integrity with limited information disclosure and modification risks. The FAUCET Risk Score of 44.0/100 indicates moderate concern, though the EPSS score of 0.0001300 suggests this specific vulnerability has minimal prevalence compared to other published CVEs. EXPLOITATION STATUS There is no evidence of active exploitation in the wild. This vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog and remains inactive on the Hot List, indicating no significant community attention or publicly available exploit code at this time. However, organizations using affected versions should prioritize patching, particularly if untrusted contributors have account access.