Plugin icon

MotoPress Hotel Booking

motopress-hotel-booking-lite

Vulnerabilities:

10

Last Updated:

October 13, 2026

Active Installs:

10000

Published
Title
Fixed in
CVSS
Published
2026-09-15
Title
MotoPress Hotel Booking < 6.3.0 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
Fixed in
Fixed in 6.3.0
CVSS
7.2 (high)
Published
2026-08-06
Title
Hotel Booking Lite < 6.2.3 - Subscriber+ Customer Data Modification via IDOR
Fixed in
Fixed in 6.2.3
CVSS
5.4 (medium)
Published
2026-08-06
Title
Hotel Booking Lite < 6.2.3 - Unauthenticated Payment Record Creation via Checkout Payments REST Endpoint
Fixed in
Fixed in 6.2.3
CVSS
5.3 (medium)
Published
2026-07-09
Title
Hotel Booking Lite < 6.0.4 - Subscriber+ Sensitive Data Disclosure via Admin Calendar AJAX Action
Fixed in
Fixed in 6.0.4
CVSS
4.3 (medium)
Published
2026-07-01
Title
MotoPress Hotel Booking < 6.0.4 - Authenticated (Subscriber+) Information Exposure
Fixed in
Fixed in 6.0.4
CVSS
4.3 (medium)
Published
2026-05-21
Title
MotoPress Hotel Booking < 6.0.2 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action
Fixed in
Fixed in 6.0.2
CVSS
5.3 (medium)
Published
2025-11-25
Title
Hotel Booking Lite < 5.2.4 - Authenticated (Hotel Worker+) Remote Code Execution
Fixed in
Fixed in 5.2.4
CVSS
5.3 (medium)
Published
2024-05-10
Title
Hotel Booking Lite < 4.11.2 - Unauthenticated PHP Object Injection
Fixed in
Fixed in 4.11.2
CVSS
9.8 (critical)
Published
2023-12-01
Title
Hotel Booking Lite < 4.8.5 - Unauthenticated Arbitrary File Download & Deletion
Fixed in
Fixed in 4.8.5
CVSS
9.8 (critical)
Published
2023-03-16
Title
Hotel Booking Lite < 4.7.0 - Settings Update via CSRF
Fixed in
Fixed in 4.7.0
CVSS
4.3 (medium)