WordPress plugin
MotoPress Hotel Booking security & vulnerabilities
No known unpatched vulnerabilities in the latest version
All 9 known vulnerabilities are fixed in the latest release. If you run an older version, update to null or newer.
- Critical2
- High1
- Medium6
- Low0
All MotoPress Hotel Booking vulnerabilities
- High7.2Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
≤6.2.4Update to 6.3.0
- Medium4.3Insecure Direct Object Reference to Authenticated (Subscriber+) Customer Data Modification
≤6.2.2Update to 6.2.3
- Medium4.3Authenticated (Subscriber+) Information Exposure
<6.0.4Update to 6.0.4
- Medium4.3Authenticated (Subscriber+) Information Exposure
≤6.0.3Update to 6.0.4
- Medium5.3Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action
≤6.0.1Update to 6.0.2
- Medium5.3Authenticated (Hotel Worker+) Remote Code Execution
≤5.2.3Update to 5.2.4
- Critical9.8Unauthenticated PHP Object Injection
≤4.11.1Update to 4.11.2
- Critical9.8Insufficient Path Validation to Unauthenticated Arbitrary File Deletion and Download
<4.8.5Update to 4.8.5
- Medium4.3Cross-Site Request Forgery to Settings Update
≤4.6.0Update to 4.7.0
MotoPress Hotel Booking: common questions
Does MotoPress Hotel Booking have known vulnerabilities?
Yes. VulnCrest Radar lists 9 known vulnerabilities in MotoPress Hotel Booking: 2 critical, 1 high, 6 medium. None are known to affect version null.
How do I check which version of MotoPress Hotel Booking I run?
In wp-admin open Plugins → Installed Plugins; the version is shown under the name. Without admin access, our passive Check my site tool can often read it from public files.
What is the most recent MotoPress Hotel Booking vulnerability?
CVE-2026-90650, published Sep 15, 2026: MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'. Severity: High (CVSS 7.2).
Is any MotoPress Hotel Booking vulnerability listed in CISA KEV?
No. None of the known MotoPress Hotel Booking vulnerabilities is currently listed in the CISA KEV catalog.