CVE-2026-120741 · Package
NO FIX YET
The MotoPress Appointment Booking Lite WordPress plugin up to and including 2.4.8 exposes a public REST endpoint that stores the customer name without sanitizing it. The stored value is later displayed unescaped to staff in the admin bookings list, so an unauthenticated attacker can plant scripts that run in the browser of anyone who views that page.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the MotoPress Appointment Booking Lite plugin at version 2.4.8 or earlier are exposed, because the customer-create REST route accepts requests without authentication. The risk reaches staff who open the admin bookings list, so sites that use the plugin for appointments are the ones to check. Sites without the plugin, or where it is deactivated, are not affected.
Not affected if plugin-deactivated, plugin-not-installed
Who cares motopress-appointment-booking-lite, self-hosted, wordpress
motopress-appointment-booking-lite under wp-content/plugins/ and read its version in the plugin header/motopress/appointment/v1/customers/create responds on your site2.4.8No fix yet, per the sources.
The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback => '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb->insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.