Live Vulnerability Intelligence
Threat Database
Search CVEs, inspect descriptions, and open detail pages with AI-assisted technical context.
Threat Entry
Updated 2026-11-07
MotoPress Appointment Booking Lite - Security Vulnerability (CVE-2026-120741)
The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permission_callback => '__return_true' and the handler's 'name' parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb->insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpa_edit_customer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web…
PLUGIN
MotoPress Appointment Booking Lite
CVE-2026-120741
Risk Score