CVE-2026-90650

The MotoPress Hotel Booking plugin for WordPress contains a stored cross-site scripting flaw in the premium Stripe gateway's webhook listener (webhook-listener.php), affecting all versions up to and including 6.2.4. Because the plugin only verifies the Stripe webhook signature when an optional signing secret is configured — and that secret is empty by default — an unauthenticated attacker can send a forged webhook event (e.g., a fake 'refund.created') that is accepted without cryptographic verification. The attacker-controlled event object 'id' is then written unescaped into the payment log and executes as arbitrary JavaScript when an administrator views the payment in the WordPress dashboard. Exploitation requires knowledge of a valid Stripe PaymentIntent ID for an existing payment, which limits the attacker pool to those with some visibility into a site's transactions. The vulnerable handler exists only in the premium Stripe integration, not the lite plugin, and no public PoC or in-the-wild exploitation is currently known.

What to do: Update MotoPress Hotel Booking to a version newer than 6.2.4 as soon as a patched release is available. Immediately configure the Stripe webhook signing secret in the plugin settings — this forces cryptographic verification of incoming webhooks and blocks forged events even on unpatched installs. Review payment log entries and admin-facing payment pages for unexpected or injected script content, and check Stripe dashboard webhook delivery logs for events that do not correspond to legitimate Stripe-originated transactions.