CVE-2026-90650: MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The premium Stripe webhook listener only verifies the webhook signature when an optional Stripe signing secret has been configured; because that secret is empty by default, a forged webhook is accepted without cryptographic verification, and the attacker-controlled event object 'id' (e.g. a forged 'refund.created' refund id) is written unescaped into the payment log and later echoed unsanitized when an administrator views the payment. An attacker must know a valid Stripe PaymentIntent ID for an existing payment to route the forged webhook to a payment record. Note: The vulnerable webhook handler (webhook-listener.php) is part of the premium Stripe gateway integration and is not present in the lite plugin directory.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MotoPress Hotel Booking (WordPress)to a version that resolves this vulnerability.Fixed in 6.2.4 - Configuration
Configure a non-empty Stripe webhook signing secret so the webhook listener verifies the webhook signature cryptographically before processing events (the vulnerable handler only verifies the signature when the optional signing secret is configured; it is empty by default).
MotoPress Hotel Booking premium Stripe gateway integration (webhook-listener.php) Stripe webhook signing secret = configured (non-empty) - Compensating control
Restrict network access to the premium Stripe webhook endpoint so only Stripe can reach it (e.g., via firewall/allowlist of Stripe webhook source IPs), reducing exposure to forged webhook requests when the signing secret is missing or misconfigured.
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
The vulnerable webhook handler is part of the premium Stripe gateway integration and is not present in the lite plugin directory. Deployments using the premium integration are exposed when the optional Stripe signing secret has not been configured, which is the default state.
What does an attacker need to exploit it?
An attacker can submit a forged Stripe webhook without authentication when no Stripe signing secret is configured. They must also know a valid Stripe PaymentIntent ID for an existing payment so the forged webhook is routed to that payment record.
When would the injected script execute?
The attacker-controlled event ID is stored in the payment log and is echoed without escaping when an administrator views the affected payment. The script therefore executes in the browser of a user accessing that payment page.
What can be done if updating is not immediately possible?
Configure the optional Stripe signing secret so the webhook listener verifies Stripe webhook signatures. This prevents forged webhooks from being accepted without cryptographic verification.