{"id":"CVE-2026-120741","aliases":["EUVD-2026-118570","GHSA-px2x-7739-98cp"],"status":"published","title":"MotoPress Appointment Booking \u003c= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint","description":"The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback =\u003e '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb-\u003einsert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00268,"percentile":0.19154,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-07T02:29:17Z","modified":"2026-11-07T03:31:18Z","products":[{"vendor":"jetmonsters","product":"motopress appointment booking"}],"references":[{"url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e9d051-3379-4f59-9970-c66c44ca2626?source=cve"},{"url":"https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/admin-pages/manage/ManageBookingsPage.php#L670"},{"url":"https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/admin-pages/manage/ManageBookingsPage.php#L689"},{"url":"https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/rest/controllers/motopress/appointment/v1/CustomersRestController.php#L165"},{"url":"https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/rest/controllers/motopress/appointment/v1/CustomersRestController.php#L24"},{"url":"https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/repositories/CustomerRepository.php#L314"},{"url":"https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/entities/Booking.php#L247"},{"url":"https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/handlers/SecurityHandler.php#L235"},{"url":"https://plugins.trac.wordpress.org/changeset/3782125"},{"url":"https://plugins.trac.wordpress.org/changeset/3782125/motopress-appointment-lite/trunk/includes/admin-pages/manage/ManageBookingsPage.php"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120741"},{"url":"https://github.com/advisories/GHSA-px2x-7739-98cp"}],"sources":{"cve":[{"id":"CVE-2026-120741","title":"MotoPress Appointment Booking \u003c= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint","description":"The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback =\u003e '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb-\u003einsert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-11-07T02:29:17.979Z","modified":"2026-11-07T18:06:08.18Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T03:32:21.038338Z"}],"euvd":[{"id":"EUVD-2026-118570","description":"The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback =\u003e '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb-\u003einsert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-11-07T02:29:17Z","modified":"2026-11-07T18:06:08Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-07T06:08:32.207523Z"}],"ghsa":[{"id":"GHSA-px2x-7739-98cp","title":"The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site...","description":"The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback =\u003e '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb-\u003einsert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-11-07T03:31:11Z","modified":"2026-11-07T03:31:18Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T03:35:32.541373Z"}],"nvd":[{"id":"CVE-2026-120741","description":"The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback =\u003e '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb-\u003einsert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.","status":"published","published":"2026-11-07T03:17:04.65Z","modified":"2026-11-07T18:17:18.477Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-07T20:06:33.424827Z"}]}}