CVE-2025-6941

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-6941", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-06-30T21:18:16.014Z", "datePublished": "2025-09-30T04:27:07.055Z", "dateUpdated": "2026-04-08T17:19:37.055Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:37.055Z"}, "affected": [{"vendor": "latepoint", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "5.1.94", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepoint_resources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c05575ef-3140-4340-9b4b-1803a8045ce0?source=cve"}, {"url": "https://wordpress.org/plugins/latepoint/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/lib/helpers/shortcodes_helper.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3366851"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "timeline": [{"time": "2025-07-08T16:23:03.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-09-29T16:24:40.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-09-30T15:39:38.627496Z", "id": "CVE-2025-6941", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:39:46.996Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-6941", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-09-30T15:39:38.627496Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-09-30T15:39:43.491Z"}}], "cna": {"title": "LatePoint <= 5.1.94 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Muhammad Yudha - DJ"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "latepoint", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "5.1.94"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-07-08T16:23:03.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-09-29T16:24:40.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c05575ef-3140-4340-9b4b-1803a8045ce0?source=cve"}, {"url": "https://wordpress.org/plugins/latepoint/#developers"}, {"url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/lib/helpers/shortcodes_helper.php"}, {"url": "https://plugins.trac.wordpress.org/changeset/3366851"}], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepoint_resources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:19:37.055Z"}}}, "cveMetadata": {"cveId": "CVE-2025-6941", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:19:37.055Z", "dateReserved": "2025-06-30T21:18:16.014Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-09-30T04:27:07.055Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "LatePoint \u2013 Calendar Booking Plugin for Appointments and Events", "vendor": "latepoint", "versions": [{"lessThanOrEqual": "5.1.94", "status": "affected", "version": "0", "versionType": "semver"}]}], "source": "security@wordfence.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The LatePoint \u2013 Calendar Booking Plugin for Appointments and Events plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'id' parameter of the 'latepoint_resources' shortcode in all versions up to, and including, 5.1.94 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}, {"lang": "es", "value": "El plugin LatePoint \u2013 Calendar Booking para Appointments and Events para WordPress es vulnerable a cross-site scripting almacenado a trav\u00e9s del par\u00e1metro 'id' del shortcode 'latepoint_resources' en todas las versiones hasta la 5.1.94, inclusive, debido a una sanitizaci\u00f3n de entrada y un escape de salida insuficientes. Esto hace posible que atacantes autenticados, con acceso de nivel Colaborador y superior, inyecten scripts web arbitrarios en p\u00e1ginas que se ejecutar\u00e1n cada vez que un usuario acceda a una p\u00e1gina inyectada."}], "id": "CVE-2025-6941", "lastModified": "2026-06-17T10:02:54.773", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2025-6941", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2025-09-30T15:39:38.627496Z", "version": "2.0.3"}}]}, "published": "2025-09-30T11:37:42.833", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/latepoint/tags/5.1.93/lib/helpers/shortcodes_helper.php"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3366851"}, {"source": "security@wordfence.com", "url": "https://wordpress.org/plugins/latepoint/#developers"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/c05575ef-3140-4340-9b4b-1803a8045ce0?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T19:25:03.494959+00:00", "value": {"mitigation_remediation": ["Update the LatePoint plugin to a version newer than 5.1.94 to eliminate the unfiltered 'id' parameter.", "If an immediate update is not possible, temporarily remove or disable the 'latepoint_resources' shortcode or block its usage through custom code until a patched version is available.", "Review role permissions so that only the most trusted users have Contributor or higher capabilities; consider restricting contributors from creating or editing content that can include custom shortcodes."], "summary": {"action": "Patch Now", "impact": "Stored Cross\u2011Site Scripting for authenticated contributors and above"}, "threat_synthesis": {"affected_systems": "This issue affects the LatePoint \u2013 Calendar Booking Plugin for Appointments and Events, a WordPress plugin available from the latepoint vendor. All releases up to and including version 5.1.94 are impacted. Users installing or upgrading to these releases should be aware that the plugin\u2019s shortcode handling is insecure for authenticated contributors and above.", "description_and_impact": "The LatePoint calendar booking plugin for WordPress contains a stored cross\u2011site scripting flaw that arises when an attacker supplies a crafted value to the 'id' attribute of the 'latepoint_resources' shortcode. Because the plugin does not properly sanitise or escape the input, the supplied value is persisted and rendered unescaped in generated pages, allowing the attacker to inject arbitrary JavaScript. The attack requires only that the user be authenticated with at least Contributor privileges, and any subsequent visitor to a page that includes the malicious shortcode will execute the injected script, potentially leading to credential theft, session hijacking, or defacement. The flaw is listed as a moderate severity vulnerability (CVSS 6.4).", "risk_and_exploitability": "The vulnerability is exploitable locally by any authenticated user with Contributor level or higher access. The EPSS score is below 1\u202f%, indicating a very low probability that this issue will be actively exploited at present, and the vulnerability is not listed in the CISA KEV catalog. Nevertheless, because the flaw allows arbitrary script execution on pages viewed by other users, the potential damage is significant if the attacker can obtain or elevate credentials to reach the Contributor role. The CVSS score of 6.4 reflects a moderate risk, but organisations should prioritise remediation to prevent a potential credential compromise or user environment compromise."}}}}, "created": "2025-09-30T08:47:28.683779+00:00", "updated": "2026-04-20T19:30:06.167535+00:00", "vendors": ["latepoint", "latepoint$PRODUCT$latepoint", "wordpress", "wordpress$PRODUCT$wordpress"]}