CVE-2022-50948: Motopress Hotel Booking XSS Vulnerability

CVE-2022-50948 Overview

CVE-2022-50948 is a stored cross-site scripting (XSS) vulnerability [CWE-79] in Motopress Hotel Booking Lite version 4.2.4. The flaw allows authenticated attackers to inject JavaScript payloads through the title and excerpt parameters when creating accommodation types. Injected scripts persist in the database and execute in any visitor's browser when they load the accommodations page. The vulnerability impacts WordPress sites running the affected plugin version and can lead to session hijacking, credential theft, or redirection to attacker-controlled infrastructure.

Critical Impact
Authenticated attackers can persistently inject malicious JavaScript that executes in the browsers of all visitors loading the affected accommodations page, enabling session theft and client-side compromise.

Affected Products

Motopress Hotel Booking Lite 4.2.4
WordPress installations using the vulnerable plugin version
Sites with public accommodations pages rendered by the plugin

Discovery Timeline

2026-05-10 - CVE-2022-50948 published to NVD
2026-05-12 - Last updated in NVD database

Technical Details for CVE-2022-50948

Vulnerability Analysis

The vulnerability resides in the accommodation type creation workflow of the Motopress Hotel Booking Lite plugin. The plugin fails to sanitize or encode user-supplied input submitted through the title and excerpt fields. An authenticated user with permission to create accommodation types can embed <script> tags or event-handler attributes in these fields. The malicious payload is stored in the WordPress database and rendered without proper escaping when the public accommodations page is requested. Any visitor loading the page executes the attacker's JavaScript in their browser session, bound to the site's origin.

Root Cause

The root cause is missing output encoding and input validation on accommodation type metadata. The plugin does not apply WordPress sanitization functions such as wp_kses_post() or esc_html() to the title and excerpt before storing or rendering them. This classifies as a Cross-Site Scripting (XSS) weakness under [CWE-79].

Attack Vector

Exploitation requires an authenticated session with privileges to create or modify accommodation types. The attacker submits a payload such as a script tag embedded in the accommodation title or excerpt field. Once saved, the payload executes for every visitor accessing the public accommodations listing. User interaction is required by the victim, who must load the affected page. See the VulnCheck Advisory for MotoPress and Exploit-DB #50951 for proof-of-concept details.

Detection Methods for CVE-2022-50948

Indicators of Compromise

Accommodation type records containing <script>, onerror=, onload=, or javascript: substrings in title or excerpt columns
Unexpected outbound requests from visitor browsers to unfamiliar domains originating from the accommodations page
New or modified posts of type mphb_room_type with HTML or JavaScript content in metadata

Detection Strategies

Query the WordPress wp_posts table for accommodation type entries containing HTML tags or script content in post_title and post_excerpt fields
Inspect web server access logs for POST requests to accommodation type creation endpoints by non-administrator accounts
Use a Content Security Policy (CSP) report-only header to surface unexpected inline script execution on accommodations pages

Monitoring Recommendations

Monitor authenticated user actions for creation or modification of accommodation types, especially by lower-privileged contributors
Alert on anomalous JavaScript execution patterns reported by browser security telemetry on public-facing booking pages
Audit WordPress role assignments to ensure only trusted accounts hold permissions for accommodation management

How to Mitigate CVE-2022-50948

Immediate Actions Required

Upgrade Motopress Hotel Booking Lite to a version later than 4.2.4 that addresses the input sanitization gap
Review existing accommodation type entries for stored payloads and remove or sanitize any malicious content
Restrict accommodation management capabilities to trusted administrative accounts only

Patch Information

Consult the vendor at the MotoPress Official Website for the latest plugin release that remediates the stored XSS vulnerability. Apply updates through the standard WordPress plugin update mechanism and verify the installed version after upgrading.

Workarounds

Implement a strict Content Security Policy (CSP) header that disallows inline scripts on pages rendered by the plugin
Deploy a Web Application Firewall (WAF) rule to block requests containing script tags or HTML event handlers in accommodation type form fields
Temporarily disable public access to the accommodations page until the plugin is patched

bash

# Example nginx CSP header to mitigate stored XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'" always;