Stored Cross-Site Scripting in MotoPress Appointment Booking Lite Plugin for WordPress

CVE-2026-120741

What is CVE-2026-120741?

The MotoPress Appointment Booking Lite plugin for WordPress is susceptible to Stored Cross-Site Scripting (XSS) through its public REST endpoint '/motopress/appointment/v1/customers/create'. This endpoint, which does not properly sanitize the 'name' parameter before inserting it into the database, enables unauthenticated attackers to inject malicious scripts. The unsanitized data can be executed in the browsers of users who view the affected pages, particularly when these users lack the 'mpa_edit_customer' capability, allowing attackers to exploit the vulnerability effectively.

References