CVE-2026-120741

The MotoPress Appointment Booking Lite plugin for WordPress (versions up to and including 2.4.8 ) is vulnerable to Stored Cross-Site Scripting (XSS) . The flaw exists in the public /motopress/appointment/v1/customers/create REST endpoint, which lacks proper permission checks (permission_callback ...