motopress_appointment_booking vulnerabilities

CVEs whose affected-version data names the motopress_appointment_booking package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-120741Medium· 5.4

yesterday

MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is regi…

▾ Sunlitjetmonsters · MotoPress Appointment BookingEPSS 0.27%via CVEORG