CVE-2026-15238

The MotoPress Hotel Booking plugin for WordPress in all versions up to and including 6.2.4 is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' due to insufficient input sanitization and output escaping. The premium Stripe webhook listener only verifies the webhook signature when an optional Stripe signing secret has been configured; because that secret is empty by default, a forged webhook is accepted without cryptographic verification, and the attacker-controlled event object 'id' is written unescaped into the payment log and later echoed unsanitized when an administrator views the payment.

The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.

The MotoPress Hotel Booking plugin for WordPress up to version 6.0.1 is vulnerable to authorization bypass. Unauthenticated attackers can overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce is output in the HTML source of every public page, so any visitor can obtain a valid nonce and perform the action without an account.