Stored Cross-Site Scripting Vulnerability in MotoPress Hotel Booking Plugin for WordPress

CVE-2026-90650

What is CVE-2026-90650?

The MotoPress Hotel Booking plugin for WordPress contains a vulnerability that allows attackers to exploit a stored cross-site scripting (XSS) flaw. This issue arises from inadequate input sanitization and output escaping, primarily through the Stripe Webhook event object 'id'. When an unauthenticated attacker crafts a forged webhook, they can inject arbitrary web scripts that execute whenever a user accesses affected pages. The premium version of the Stripe webhook integration only verifies incoming webhooks against a signing secret if configured, which is absent by default; leading to potential acceptance of malicious webhooks without cryptographic validation. This vulnerability primarily affects versions up to 6.2.4.

References