Vulnerability · Published Nov 7, 2026 · Assigned by Wordfence

CVE-2026-120741MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint

Medium 5.4

In plain English

A medium-severity cross-site scripting in MotoPress Appointment Booking from jetmonsters. There are no confirmed reports of exploitation so far.

Severity (CVSS 3.1)5.4Medium

Exploit odds (30 days)–no EPSS score yet

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback => '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb->insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected products (as reported)

Vendor	Product	Versions
jetmonsters	MotoPress Appointment Booking	0 – through 2.4.8

Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N

In plain English

Official description

Affected products (as reported)

References