---
id: CVE-2026-120741
title: >-
  MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site
  Scripting via Customer Name via /customers/create REST Endpoint
summary: >-
  The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to
  Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the
  public '/motopress/appointment/v1/customers/create' REST endpoint. The route
  is regi…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: jetmonsters
product: MotoPress Appointment Booking
affected:
  - motopress_appointment_booking <= 2.4.8
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-11-07T18:02:26.940812Z'
published: '2026-11-07'
updated: '2026-11-07'
sourceUpdated: '2026-11-07T18:06:08.180Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-120741'
references:
  - url: >-
      https://www.wordfence.com/threat-intel/vulnerabilities/id/f4e9d051-3379-4f59-9970-c66c44ca2626?source=cve
  - url: >-
      https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/admin-pages/manage/ManageBookingsPage.php#L670
  - url: >-
      https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/admin-pages/manage/ManageBookingsPage.php#L689
  - url: >-
      https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/rest/controllers/motopress/appointment/v1/CustomersRestController.php#L165
  - url: >-
      https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/rest/controllers/motopress/appointment/v1/CustomersRestController.php#L24
  - url: >-
      https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/repositories/CustomerRepository.php#L314
  - url: >-
      https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/entities/Booking.php#L247
  - url: >-
      https://plugins.trac.wordpress.org/browser/motopress-appointment-lite/tags/2.4.8/includes/handlers/SecurityHandler.php#L235
  - url: 'https://plugins.trac.wordpress.org/changeset/3782125'
  - url: >-
      https://plugins.trac.wordpress.org/changeset/3782125/motopress-appointment-lite/trunk/includes/admin-pages/manage/ManageBookingsPage.php
tags:
  - cve.org
epss: 0.00268
epssPercentile: 0.19056
ingestedAt: '2026-11-07T03:08:38.903Z'
---

## Overview

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback => '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb->insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

## Affected

- `motopress_appointment_booking <= 2.4.8`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.