Jetmonsters MotoPress Hotel Booking

• CVE-2026-90650 High 7.2 MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id' 0.4%
• CVE-2026-8684 Medium 5.3 MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action 0.3%
• CVE-2024-4413 Critical 9.8 Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection 0.9%