Jetmonsters MotoPress Appointment Booking

• CVE-2026-120741 Medium 5.4 MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint –
• CVE-2026-9180 Medium 5.3 MotoPress Appointment Booking <= 2.4.4 - Unauthenticated Insecure Direct Object Reference to 'payment_details.booking_id' Parameter 0.6%
• CVE-2026-13454 Medium 6.5 MotoPress Appointment Booking <= 2.4.5 - Authenticated (Staff+) SQL Injection via 's' Parameter 0.5%