CVE-2026-120741

Description

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback => '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb->insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

References

• https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/admin-pages/manage/ManageBookingsPage.php#L670
• https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/admin-pages/manage/ManageBookingsPage.php#L689
• https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/entities/Booking.php#L247
• https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/handlers/SecurityHandler.php#L235
• https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/repositories/CustomerRepository.php#L314