CVE-2025-6941 Overview
CVE-2025-6941 is a Stored Cross-Site Scripting (XSS) vulnerability in the LatePoint – Calendar Booking Plugin for Appointments and Events, a WordPress plugin used to manage bookings and appointments. The flaw affects all versions up to and including 5.1.94. The vulnerability resides in the id parameter of the latepoint_resources shortcode, where insufficient input sanitization and output escaping allow authenticated users with Contributor-level access or higher to inject arbitrary JavaScript into pages. Injected scripts execute in the browser of any user who views the affected page. The issue is tracked under CWE-79.
Critical Impact
Authenticated contributors can inject persistent JavaScript that executes against site visitors and administrators, enabling session theft, account takeover, and content manipulation.
Affected Products
- LatePoint – Calendar Booking Plugin for Appointments and Events (WordPress plugin)
- All versions up to and including 5.1.94
- WordPress sites allowing Contributor-level or higher accounts to use shortcodes
Discovery Timeline
- 2025-09-30 - CVE-2025-6941 published to NVD
- 2026-06-17 - Last updated in NVD database
Technical Details for CVE-2025-6941
Vulnerability Analysis
The LatePoint plugin exposes a latepoint_resources shortcode handled by its shortcodes helper. The handler reads the id attribute supplied by the shortcode author and renders it back into the page markup without applying adequate sanitization or escaping. Because WordPress Contributors can author posts containing shortcodes, an attacker with Contributor privileges can embed a crafted [latepoint_resources id="..."] tag that stores malicious script content in the post. Any visitor who later renders the page triggers execution of attacker-controlled JavaScript in their browser context. This is a classic stored XSS pattern [CWE-79] where tainted input flows directly to an HTML sink.
Root Cause
The root cause is missing input sanitization on the shortcode attribute and missing output escaping when the attribute is reflected into the rendered HTML. The vulnerable logic can be reviewed in the plugin source at WordPress Plugin Shortcode Helper. The developer did not apply WordPress escaping APIs such as esc_attr() or esc_html() before emitting the value.
Attack Vector
The attack is network-reachable and requires low privileges (Contributor role) but no user interaction beyond a victim loading the page. An attacker creates or edits a post, inserts the latepoint_resources shortcode with a malicious id attribute containing an HTML event handler or <script> payload, and submits the content. When an editor, administrator, or site visitor views the post, the payload executes in their session. The scope change (S:C) reflects script execution crossing the plugin's trust boundary into the WordPress admin and visitor contexts. See the Wordfence Vulnerability Analysis CVE for the full disclosure.
Detection Methods for CVE-2025-6941
Indicators of Compromise
- Post or page content containing [latepoint_resources shortcodes with id attributes holding HTML tags, quotes, or JavaScript keywords such as onerror, onload, or <script.
- Unexpected outbound requests from administrator browsers to attacker-controlled domains after viewing posts.
- New or modified WordPress administrator accounts created shortly after a Contributor edited a post containing the shortcode.
Detection Strategies
- Query the wp_posts table for post_content matching latepoint_resources combined with suspicious characters: SELECT ID, post_author FROM wp_posts WHERE post_content REGEXP 'latepoint_resources[^]]*id="[^"]*(<|script|onerror|javascript:)'.
- Deploy web application firewall rules that flag shortcode attributes containing angle brackets, on*= event handlers, or javascript: URIs.
- Review audit logs for Contributor-level users who recently published or updated posts containing LatePoint shortcodes.
Monitoring Recommendations
- Enable Content Security Policy (CSP) headers that restrict inline script execution and alert on CSP violation reports.
- Monitor the LatePoint plugin version across all WordPress installations and alert on any deployment running 5.1.94 or earlier.
- Track browser-side errors and script-origin anomalies on administrator sessions through RUM or EDR telemetry.
How to Mitigate CVE-2025-6941
Immediate Actions Required
- Update the LatePoint plugin to a version later than 5.1.94 on all WordPress installations as the primary remediation.
- Audit all Contributor, Author, and Editor accounts and remove unused or untrusted users with shortcode-authoring capability.
- Review existing posts and pages for the latepoint_resources shortcode and remove any instances containing untrusted id values.
Patch Information
The maintainer addressed the vulnerability in the plugin repository. The fix is documented in WordPress Plugin Changeset 3366851, which introduces proper sanitization and escaping of shortcode attributes. Confirm the installed version is newer than 5.1.94 by checking the plugin header or the LatePoint Plugin Developer Info page.
Workarounds
- Temporarily deactivate the LatePoint plugin until the patched version is deployed if updating is not immediately feasible.
- Restrict shortcode usage by removing the unfiltered_html capability from lower-privilege roles and limiting who can edit posts.
- Deploy a WAF rule that strips or blocks latepoint_resources shortcodes containing HTML metacharacters in the id attribute.
# Configuration example: update LatePoint via WP-CLI
wp plugin update latepoint
wp plugin get latepoint --field=version
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
