Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · motopress-hotel-booking-lite
Hotel Booking Lite
10 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 15, 2026MotoPress Hotel Booking: Stored Cross-Site ScriptingCVE-2026-90650 · affects up to 6.2.4 · reported by WordfenceHigh 7.2
The MotoPress Hotel Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Stripe Webhook event object 'id' in all versions up to, and including, 6.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The premium Stripe webhook listener only verifies the webhook signature when an optional Stripe signing secret has been configured; because that secret is empty by default, a forged webhook is accepted without cryptographic verification, and the attacker-controlled event object 'id' (e.g. a forged 'refund.created' refund id) is written unescaped into the payment log and later echoed unsanitized when an administrator views the payment. An attacker must know a valid Stripe PaymentIntent ID for an existing payment to route the forged webhook to a payment record. Note: The vulnerable webhook handler (webhook-listener.php) is part of the premium Stripe gateway integration and is not present in the lite plugin directory.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 10, 2026MotoPress Hotel Booking: Does not verify record ownership before updating customer recordsCVE-2026-15238 · fixed in 6.2.3 · reported by WPScanMedium 5.4
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not verify record ownership before updating customer records, allowing any authenticated user with a low-privileged account (Subscriber and above) to modify or overwrite the personal data of any customer by supplying an arbitrary identifier.
Aug 10, 2026MotoPress Hotel Booking: Does not perform any authorization or ownership check on a REST endpoint that creates payment recordsCVE-2026-15237 · fixed in 6.2.3 · reported by WPScanMedium 5.3
The MotoPress Hotel Booking WordPress plugin before 6.2.3 does not perform any authorization or ownership check on a REST endpoint that creates payment records, allowing unauthenticated users to create completed payment records against arbitrary bookings and falsely mark them as paid.
Jul 30, 2026MotoPress Hotel Booking: Does not perform a capability check before returning a booking's full customer details in one of its AJAX actionsCVE-2026-15235 · fixed in 6.0.4 · reported by WPScanMedium 4.3
The MotoPress Hotel Booking WordPress plugin before 6.0.4 does not perform a capability check before returning a booking's full customer details in one of its AJAX actions, allowing any authenticated user with a low-privileged account (Subscriber and above) to read the personal data, including name, email, phone, and address, of any customer.
Jul 2, 2026Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.CVE-2026-57347 · reported by PatchstackMedium 6.5
Subscriber Sensitive Data Exposure in Hotel Booking Lite <= 6.0.3 versions.
May 22, 2026MotoPress Hotel Booking: Authorization bypassCVE-2026-8684 · affects up to 6.0.1 · reported by WordfenceMedium 5.3
The MotoPress Hotel Booking plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 6.0.1. This is due to the plugin not properly verifying that a user is authorized to perform an action. This makes it possible for unauthenticated attackers to overwrite or delete the internal notes (_mphb_booking_internal_notes) of any booking by supplying an arbitrary booking ID. The nonce for this action is output in the HTML source of every public page through wp_localize_script (MPHB._data.nonces), so any unauthenticated visitor can obtain a valid nonce and perform the action without any account or prior interaction.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 18, 2025Hotel Booking Lite: Improper Control of Generation of Code ('Code Injection')CVE-2025-66078 · affects up to 5.2.3 · reported by PatchstackCritical 9.1
Improper Control of Generation of Code ('Code Injection') vulnerability in jetmonsters Hotel Booking Lite motopress-hotel-booking-lite allows Remote Code Inclusion.This issue affects Hotel Booking Lite: from n/a through <= 5.2.3.
May 14, 2024Hotel Booking Lite: PHP Object InjectionCVE-2024-4413 · affects up to 4.11.1 · reported by WordfenceCritical 9.8
The Hotel Booking Lite plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 4.11.1 via deserialization of untrusted input. This makes it possible for unauthenticated attackers to inject a PHP Object. No known POP chain is present in the vulnerable plugin. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Dec 26, 2023Hotel Booking Lite: Does not validate file paths provided via user inputCVE-2023-5991 · fixed in 4.8.5 · reported by WPScanCritical 9.8
The Hotel Booking Lite WordPress plugin before 4.8.5 does not validate file paths provided via user input, as well as does not have proper CSRF and authorisation checks, allowing unauthenticated users to download and delete arbitrary files on the server
Nov 12, 2023Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions.CVE-2023-28498 · affects up to 4.6.0 · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in MotoPress Hotel Booking Lite plugin <= 4.6.0 versions.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.