Stored Cross-Site Scripting in MotoPress Hotel Booking Plugin

The MotoPress Hotel Booking plugin for WordPress, in versions up to and including 6.2.4, contains a vulnerability that allows unauthenticated attackers to execute Stored Cross-Site Scripting (XSS). The vulnerability exists within the premium Stripe gateway integration's webhook handler, located in webhook-listener.php. Because the plugin defaults to having no Stripe signing secret configured, the webhook handler fails to cryptographically verify incoming Stripe webhook events. An attacker can submit a forged webhook, such as a crafted 'refund.created' event, containing a malicious payload in the 'id' field of the event object. This payload is stored directly in the plugin's payment logs without sanitization. The vulnerability is triggered when an administrator subsequently accesses the payment logs through the WordPress dashboard, causing the stored script to execute within the administrator's session context. This vulnerability presents a significant risk to site administration, potentially leading to unauthorized actions or credential theft.

Attack Chain

1. Attacker identifies a target WordPress site using the MotoPress Hotel Booking plugin with the premium Stripe integration enabled.
2. Attacker obtains a valid Stripe PaymentIntent ID associated with the target's legitimate payment records.
3. Attacker crafts a forged Stripe webhook request, setting the 'id' field of the event object to a malicious JavaScript payload.
4. Attacker sends the forged POST request to the plugin's webhook endpoint (typically accessible via public URL).
5. The webhook-listener.php script receives the POST request and, due to the default absence of a signing secret, fails to verify the signature.
6. The plugin extracts the malicious 'id' value from the request and writes it to the database as part of the payment log.
7. A site administrator logs into the WordPress dashboard and navigates to the payment history page.
8. The application displays the payment log, rendering the unsanitized malicious payload in the administrator's browser, triggering script execution.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator's browser session. This can result in unauthorized administrative actions, site configuration changes, theft of session tokens, or further compromise of the WordPress environment. The vulnerability impacts all users of the MotoPress Hotel Booking premium plugin running versions 6.2.4 and earlier.

Recommendation

Prioritize the update of the MotoPress Hotel Booking plugin to version 6.2.5 or later to resolve the input validation and signature verification flaws associated with CVE-2026-90650. Ensure that a unique and complex Stripe signing secret is generated and configured in the plugin settings to enforce cryptographic signature verification for all incoming webhooks. Monitor web server logs for high volumes of POST requests to the plugin's webhook endpoint originating from non-Stripe IP addresses.