Vulnerability · Published May 10, 2026 · Assigned by VulnCheck

CVE-2022-50948Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting

Medium 6.4

In plain English

A medium-severity cross-site scripting in Motopress Hotel Booking Lite from Motopress. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 9% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.2%top 91.2% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Motopress Hotel Booking Lite 4.2.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting payloads in accommodation type fields. Attackers can inject script tags through the title and excerpt parameters when creating accommodation types, which execute in the browser when visitors access the accommodations page.

Affected products (as reported)

Vendor	Product	Versions
Motopress	Motopress Hotel Booking Lite	4.2.4

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

References

ExploitDB-50951 exploit
Official Product Homepage product
VulnCheck Advisory: Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting third-party-advisory