CVE-2026-90650 is a stored cross-site scripting flaw in the MotoPress Hotel Booking plugin for WordPress, in all versions up to and including 6.2.4. An unauthenticated attacker can plant script through a forged Stripe webhook. NVD scores it High (7.2). Update the plugin and set a Stripe signing secret.
What's affected
The record lists all versions up to and including 6.2.4. The weakness is CWE-79, cross-site scripting. The vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N.
The record adds details that narrow who is affected. The vulnerable webhook handler is part of the premium Stripe gateway integration and is not present in the lite plugin directory. The handler verifies the webhook signature only when an optional Stripe signing secret has been configured, and that secret is empty by default. The attacker also needs a valid Stripe payment identifier for an existing payment.
We could not read the plugin changeset page, so we cannot confirm which release fixes it. Check the plugin's changelog and the Wordfence entry linked from the record for the fixed version, and update to the newest release in any case.
How to check if you're exposed
Work out whether you use the Stripe gateway add-on. In the WordPress admin, look at the plugins list and at the payment gateway settings for MotoPress Hotel Booking. If you only run the lite plugin without the premium Stripe integration, the record says the handler is not there.
Then check the signing secret. In your payment gateway settings and in your Stripe dashboard, confirm that a webhook signing secret is configured on both sides. An empty field is the dangerous state. Look at the payment log entries in the admin for odd values in identifier fields.
Paste a lockfile or SBOM into the free in-browser dependency scan to see whether this package is in your tree, including as a transitive dependency. Safeguard's reachability analysis can then show whether your code actually calls the affected path, which helps you order the work.
What to do now
- Update MotoPress Hotel Booking and its Stripe add-on to the latest release available, after checking the changelog for the fix.
- Set the Stripe webhook signing secret in the plugin so that signatures are verified.
- Look through payment log entries for unexpected content, and clear anything suspicious.
- Keep administrator accounts to those who need them, and use a separate browser profile for admin work.
Why it matters
This is two weaknesses stacked together. The first is a webhook endpoint that does not insist on a valid signature unless an optional secret is set, so anyone can send it a fake event. The second is output handling: a value from the event is written to the payment log without cleaning and later shown unescaped when an administrator views the payment.
The result is that a stranger can leave script waiting for an administrator, which then runs in the administrator's session. That is why the scope is marked as changed. Verifying webhooks and escaping output are both basic controls, and the fix needs both. The KEV flag in the record is false and no source we read reports exploitation.
Quick check
Does the free plugin have the flaw?
The record says the vulnerable handler is in the premium Stripe gateway integration and not in the lite plugin directory.
Which version fixes it?
We could not confirm. Check the plugin changelog and the Wordfence entry.
Sources
Last reviewed: 18 October 2026.
