CVE-2026-120741: MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permissioncallback => 'returntrue' and the handler's 'name' parameter is not sanitized before being written to the custom wpmpacustomers table via $wpdb->insert, nor is it escaped on output in the admin bookings list when the viewing user lacks the 'mpaeditcustomer' capability (such as the plugin-defined Appointment Employee role). This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.