CVE-2026-90650
Received Received - Intake

Stored XSS in MotoPress Hotel Booking WordPress Plugin

Publication date: 2026-09-15

Last updated on: 2026-09-15

Assigner: Wordfence

Description
The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The premium Stripe webhook listener only verifies the webhook signature when an optional Stripe signing secret has been configured; because that secret is empty by default, a forged webhook is accepted without cryptographic verification, and the attacker-controlled event object 'id' (e.g. a forged 'refund.created' refund id) is written unescaped into the payment log and later echoed unsanitized when an administrator views the payment. An attacker must know a valid Stripe PaymentIntent ID for an existing payment to route the forged webhook to a payment record. Note: The vulnerable webhook handler (webhook-listener.php) is part of the premium Stripe gateway integration and is not present in the lite plugin directory.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-15
Last Modified
2026-09-15
Generated
2026-09-15
AI Q&A
2026-09-15
EPSS Evaluated
N/A
NVD
CVE-2026-90650
EUVD
EUVD-2026-78574

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
motopress hotel_booking to 6.2.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The MotoPress Hotel Booking plugin for WordPress has a stored cross-site scripting (XSS) vulnerability in versions up to 6.2.4. It occurs because the Stripe webhook event object 'id' is not properly sanitized before being stored or displayed. Attackers can inject malicious scripts that execute when an administrator views payment logs.

Detection Guidance

This vulnerability involves a WordPress plugin (MotoPress Hotel Booking) with Stored XSS via Stripe webhook handling. Detection requires checking plugin versions and webhook configurations. Inspect WordPress installations for the plugin up to version 6.2.4. Review Stripe webhook settings for missing signing secret. Check payment logs for unsanitized event objects like 'refund.created'.

Impact Analysis

An unauthenticated attacker could inject malicious scripts into payment logs. When an administrator views these logs, the scripts execute, potentially stealing session cookies, redirecting to phishing pages, or performing actions on behalf of the admin. The attacker needs a valid Stripe PaymentIntent ID to route the forged webhook.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. If exploited, it may result in data breaches, triggering compliance violations and potential legal penalties.

Mitigation Strategies

Update the MotoPress Hotel Booking plugin to the latest version beyond 6.2.4. If using the Stripe webhook integration, configure the Stripe signing secret to enable signature verification. Review payment logs for suspicious entries and remove any unauthorized scripts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-90650. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart