Executive brief
MotoPress Hotel Booking is a WordPress plugin for managing hotel reservations and payments. The plugin contains a stored cross-site scripting (XSS) vulnerability in its Stripe payment integration that allows unauthenticated attackers to inject malicious scripts into payment records. When site administrators view payment details, the injected script executes, potentially compromising admin accounts or leading to unauthorized changes to the booking system.
Technical details
The vulnerability is a Stored XSS flaw in the premium Stripe webhook handler (webhook-listener.php) caused by insufficient input sanitization and output escaping of the Stripe webhook event object 'id' field. The webhook endpoint only verifies the webhook signature when a Stripe signing secret is configured; since this secret is empty by default, attackers can send forged webhooks without cryptographic verification. The attacker-controlled 'id' field is written unescaped into the payment log and later echoed unsanitized when an administrator views the payment record in the WordPress admin panel. Successful exploitation requires knowledge of a valid Stripe PaymentIntent ID for an existing payment to route the forged webhook to the correct payment record. The vulnerability affects all versions up to and including 6.2.4.
Affected products
- MotoPress Hotel Booking up to and including 6.2.4
Timeline
- 2026-09-15: disclosed