{"id":"CVE-2026-120741","kind":"vulnerability","aliases":["CVE-2026-120741"],"related":[],"title":"MotoPress Appointment Booking Lite WordPress plugin: unauthenticated stored script injection","description":"The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback => '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb->insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","summary":"The MotoPress Appointment Booking Lite WordPress plugin up to and including 2.4.8 exposes a public REST endpoint that stores the customer name without sanitizing it. The stored value is later displayed unescaped to staff in the admin bookings list, so an unauthenticated attacker can plant scripts that run in the browser of anyone who views that page.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["motopress-appointment-booking-lite","package","self-hosted","wordpress"],"not_affected_if":["plugin-deactivated","plugin-not-installed"],"how_to_check":"- Look for the plugin's folder `motopress-appointment-booking-lite` under `wp-content/plugins/` and read its version in the plugin header\n- Check whether the public route `/motopress/appointment/v1/customers/create` responds on your site\n- Confirm the installed version is above `2.4.8`","fix":null,"status":"open","published_at":"2026-11-07T03:17:04+00:00","first_seen_at":"2026-11-07T03:45:35+00:00","triaged_at":"2026-11-07T03:47:58+00:00","updated_at":"2026-11-07T03:47:58+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-07T03:47:58Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"MotoPress Appointment Booking Lite WordPress plugin: unauthenticated stored script injection","impact":"medium","summary":"The MotoPress Appointment Booking Lite WordPress plugin up to and including 2.4.8 exposes a public REST endpoint that stores the customer name without sanitizing it. The stored value is later displayed unescaped to staff in the admin bookings list, so an unauthenticated attacker can plant scripts that run in the browser of anyone who views that page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","motopress-appointment-booking-lite","self-hosted"],"confidence":0.7,"fix_status":"unknown","needs_auth":"no","worst_case":"Scripts run in staff browsers viewing the bookings list.","analyst_note":"Confirm the fixed version from the plugin's changelog or the WordPress.org plugin page; the NVD text gives no fixed version.","how_to_check":"- Look for the plugin's folder `motopress-appointment-booking-lite` under `wp-content/plugins/` and read its version in the plugin header\n- Check whether the public route `/motopress/appointment/v1/customers/create` responds on your site\n- Confirm the installed version is above `2.4.8`","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed","plugin-deactivated"],"who_is_affected":"Sites running the MotoPress Appointment Booking Lite plugin at version 2.4.8 or earlier are exposed, because the customer-create REST route accepts requests without authentication. The risk reaches staff who open the admin bookings list, so sites that use the plugin for appointments are the ones to check. Sites without the plugin, or where it is deactivated, are not affected.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000773,"input_tokens":4395,"output_tokens":667,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-120741':13A,16A '-2026':12A,15A '/motopress/appointment/v1/customers/create':110C '2.4.8':38B,106C 'access':194C 'admin':63B,152C 'anyon':79B 'appoint':2A,19B,29B,86C,171C 'arbitrari':183C 'attack':69B,180C 'book':3A,20B,30B,64B,87C,153C 'browser':77B 'callback':119C 'capabl':164C 'cross':97C 'cross-sit':96C 'custom':47B,136C,139C,163C 'cve':11A,14A 'defin':170C 'display':57B 'edit':162C 'employe':172C 'endpoint':43B,112C 'escap':147C 'execut':190C 'expos':39B 'handler':124C 'host':25B 'includ':37B,105C 'inject':10A,182C,196C 'insert':143C 'lack':159C 'later':56B 'list':65B,154C 'lite':4A,21B,31B,88C 'make':175C 'motopress':1A,18B,28B,85C 'motopress-appointment-booking-lit':17B 'mpa':138C,161C 'name':48B,126C 'output':149C 'packag':22B 'page':83B,187C,197C 'paramet':127C 'permiss':118C 'plant':71B 'plugin':6A,33B,89C,169C 'plugin-defin':168C 'possibl':177C 'public':41B,109C 'regist':116C 'rest':42B,111C 'return':120C 'role':173C 'rout':114C 'run':74B 'sanit':50B,130C 'script':9A,72B,99C,185C 'self':24B 'self-host':23B 'site':98C 'staff':60B 'store':8A,45B,53B,95C 'tabl':140C 'true':121C 'unauthent':7A,68B,179C 'unescap':58B 'user':158C,193C 'valu':54B 'version':101C 'via':107C,141C 'view':81B,157C 'vulner':93C 'web':184C 'whenev':191C 'without':49B 'wordpress':5A,26B,32B,91C 'wp':137C 'wpdb':142C 'written':133C","nicknames":[],"mitigations":[],"who_affected":"Sites running the MotoPress Appointment Booking Lite plugin at version 2.4.8 or earlier are exposed, because the customer-create REST route accepts requests without authentication. The risk reaches staff who open the admin bookings list, so sites that use the plugin for appointments are the ones to check. Sites without the plugin, or where it is deactivated, are not affected.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","motopressappointmentbookinglite","package","selfhosted","wordpress"],"campaign_type":null,"search_a":"'-120741':13A,16A '-2026':12A,15A 'appoint':2A 'book':3A 'cve':11A,14A 'inject':10A 'lite':4A 'motopress':1A 'plugin':6A 'script':9A 'store':8A 'unauthent':7A 'wordpress':5A","search_b":"'2.4.8':38B 'admin':63B 'anyon':79B 'appoint':19B,29B 'attack':69B 'book':20B,30B,64B 'browser':77B 'custom':47B 'display':57B 'endpoint':43B 'expos':39B 'host':25B 'includ':37B 'later':56B 'list':65B 'lite':21B,31B 'motopress':18B,28B 'motopress-appointment-booking-lit':17B 'name':48B 'packag':22B 'page':83B 'plant':71B 'plugin':33B 'public':41B 'rest':42B 'run':74B 'sanit':50B 'script':72B 'self':24B 'self-host':23B 'staff':60B 'store':45B,53B 'unauthent':68B 'unescap':58B 'valu':54B 'view':81B 'without':49B 'wordpress':26B,32B","search_c":"'/motopress/appointment/v1/customers/create':110C '2.4.8':106C 'access':194C 'admin':152C 'appoint':86C,171C 'arbitrari':183C 'attack':180C 'book':87C,153C 'callback':119C 'capabl':164C 'cross':97C 'cross-sit':96C 'custom':136C,139C,163C 'defin':170C 'edit':162C 'employe':172C 'endpoint':112C 'escap':147C 'execut':190C 'handler':124C 'includ':105C 'inject':182C,196C 'insert':143C 'lack':159C 'list':154C 'lite':88C 'make':175C 'motopress':85C 'mpa':138C,161C 'name':126C 'output':149C 'page':187C,197C 'paramet':127C 'permiss':118C 'plugin':89C,169C 'plugin-defin':168C 'possibl':177C 'public':109C 'regist':116C 'rest':111C 'return':120C 'role':173C 'rout':114C 'sanit':130C 'script':99C,185C 'site':98C 'store':95C 'tabl':140C 'true':121C 'unauthent':179C 'user':158C,193C 'version':101C 'via':107C,141C 'view':157C 'vulner':93C 'web':184C 'whenev':191C 'wordpress':91C 'wp':137C 'wpdb':142C 'written':133C","first_public_at":"2026-11-07T03:17:04+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120741","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120741","severity":null,"published_at":"2026-11-07T03:17:04+00:00","modified_at":"2026-11-07T03:17:04+00:00","first_seen_at":"2026-11-07T03:45:35+00:00","fetched_at":"2026-11-07T03:45:35+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}