CVE-2026-120741

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permissioncallback = 'returntrue' and the...

EUVD-2026-118570

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permissioncallback = 'returntrue' and the...

CVE-2026-120741 MotoPress Appointment Booking <= 2.4.8 - Unauthenticated Stored Cross-Site Scripting via Customer Name via /customers/create REST Endpoint

The MotoPress Appointment Booking Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.4.8 via the public '/motopress/appointment/v1/customers/create' REST endpoint. The route is registered with permissioncallback = 'returntrue' and the...

CVE-2026-120741

The MotoPress Appointment Booking Lite plugin for WordPress (versions up to and including 2.4.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the public /motopress/appointment/v1/customers/create REST endpoint, which lacks proper permission checks (permission_callback ...

CVE-2026-47743

Shopper is a Headless e-commerce Admin Panel. Prior to 2.8.0, three related defects on admin Livewire components allowed data tampering, sensitive data disclosure, and stored XSS. First, several Livewire components in the admin panel exposed Eloquent model identifiers as public properties without...