CVE-2026-90650: MotoPress Hotel Booking XSS Vulnerability

CVE-2026-90650 Overview

CVE-2026-90650 is a Stored Cross-Site Scripting (XSS) vulnerability in the MotoPress Hotel Booking plugin for WordPress. The flaw exists in the premium Stripe gateway integration through version 6.2.4. Unauthenticated attackers can inject arbitrary JavaScript into payment log records by sending forged Stripe webhook events. The injected script executes in the browser of any administrator who views the affected payment record. The weakness maps to Improper Neutralization of Input During Web Page Generation [CWE-79].

Critical Impact
An unauthenticated attacker who knows a valid Stripe PaymentIntent ID can persist attacker-controlled scripts into admin pages, enabling session theft, privilege abuse, or arbitrary actions in the WordPress administrator context.

Affected Products

MotoPress Hotel Booking plugin for WordPress (premium Stripe gateway integration)
All versions up to and including 6.2.4
Sites where the optional Stripe signing secret is not configured (default state)

Discovery Timeline

2026-09-15 - CVE-2026-90650 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-90650

Vulnerability Analysis

The vulnerability sits in the premium Stripe webhook listener (webhook-listener.php), which is bundled with the paid Stripe gateway integration and is not present in the lite plugin. The listener only performs cryptographic verification of the Stripe signature when an optional signing secret has been configured. Because that secret is empty by default, the handler accepts forged webhook payloads without validating their origin.

When a forged event such as refund.created is submitted, the attacker-supplied event object id is written into the payment log without sanitization. Later, when an administrator opens the payment in the WordPress admin, the stored value is echoed back to the page without output escaping. This produces stored XSS in an authenticated administrative context.

Exploitation requires the attacker to know a valid Stripe PaymentIntent ID for an existing payment so the forged event routes to a real payment record. That constraint reduces mass exploitability but does not prevent targeted abuse against a known booking.

Root Cause

The root cause is twofold. First, webhook authenticity is treated as optional rather than mandatory, so unsigned webhooks are trusted when the signing secret is absent. Second, the payment log write path in payment.php and the admin render path in payment-edit-cpt-page.php fail to apply input sanitization or output escaping to Stripe-provided identifiers.

Attack Vector

The attack is network-based and unauthenticated. An attacker sends a crafted HTTP POST to the plugin's Stripe webhook endpoint containing a forged event object whose id field carries an HTML or JavaScript payload. The forged event references a known PaymentIntent ID. The malicious payload is persisted to the payment record and later executes when an administrator views that record in the WordPress dashboard.

See the vendor code paths for the vulnerable sinks: Payment Edit Page, Payment Entity, and Notification Listener.

Detection Methods for CVE-2026-90650

Indicators of Compromise

Payment log entries whose stored Stripe id value contains HTML tags, <script> fragments, event handlers such as onerror=, or javascript: URIs.
Requests to the Stripe webhook endpoint from source IPs not owned by Stripe when the signing secret is unset.
refund.created or similar Stripe events arriving without a valid Stripe-Signature header.
Unexpected outbound requests from administrator browsers immediately after viewing a payment record.

Detection Strategies

Inspect the WordPress postmeta and payment log tables for stored values containing angle brackets or script tokens in Stripe identifier fields.
Correlate webhook POSTs against Stripe's published IP ranges and flag those missing signature headers.
Review WordPress admin session activity for anomalous XHR or fetch calls originating from payment edit screens.

Monitoring Recommendations

Enable web application firewall logging on the plugin's webhook route and retain full request bodies for forensic review.
Alert on administrator account changes, new user creation, or role escalation shortly after a payment view event.
Baseline expected Stripe event volumes and alert on spikes of refund.created or unknown event types.

How to Mitigate CVE-2026-90650

Immediate Actions Required

Update the MotoPress Hotel Booking plugin to a version later than 6.2.4 that includes the fix from changeset 3694788.
Configure a Stripe webhook signing secret in the plugin settings so signature verification becomes enforced.
Audit existing payment records for injected markup and purge or sanitize affected entries before administrators open them.

Patch Information

The vendor released a fix tracked in WordPress plugin repository changeset 3694788. Refer to the Wordfence advisory for additional remediation guidance and version confirmation.

Workarounds

Set a Stripe webhook signing secret to force cryptographic verification of every inbound event.
Restrict the webhook endpoint at the web server or WAF layer to Stripe's published IP ranges.
Temporarily disable the premium Stripe gateway integration until the plugin is updated if signature verification cannot be enforced.

bash

# Example WAF rule concept: reject Stripe webhook POSTs missing a signature header
# (Adapt syntax to your WAF or reverse proxy)
location /?mphb_payment_gateway_callback=stripe {
    if ($http_stripe_signature = "") { return 403; }
}