https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 11 Nov 2026 13:09:30 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-120741 <p>The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public &#39;/motopress/appointment/v1/customers/create&#39; REST endpoint. The route is registered with permission_callback =&gt; &#39;__return_true&#39; and the handler&#39;s &#39;name&#39; parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb-&gt;insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the &#39;mpa_edit_customer&#39; capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p>The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public &#39;/motopress/appointment/v1/customers/create&#39; REST endpoint. The route is registered with permission_callback =&gt; &#39;__return_true&#39; and the handler&#39;s &#39;name&#39; parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb-&gt;insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the &#39;mpa_edit_customer&#39; capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://db.gcve.eu/vuln/fkie_cve-2026-120741 https://db.gcve.eu/vuln/ghsa-px2x-7739-98cp <p>The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public &#39;/motopress/appointment/v1/customers/create&#39; REST endpoint. The route is registered with permission_callback =&gt; &#39;__return_true&#39; and the handler&#39;s &#39;name&#39; parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb-&gt;insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the &#39;mpa_edit_customer&#39; capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> <p>The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public &#39;/motopress/appointment/v1/customers/create&#39; REST endpoint. The route is registered with permission_callback =&gt; &#39;__return_true&#39; and the handler&#39;s &#39;name&#39; parameter is not sanitized before being written to the custom wp_mpa_customers table via $wpdb-&gt;insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the &#39;mpa_edit_customer&#39; capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.</p> https://db.gcve.eu/vuln/ghsa-px2x-7739-98cp