CVE-2026-90650 is a stored Cross-Site Scripting vulnerability in the MotoPress Hotel Booking plugin for WordPress, specifically in the premium Stripe webhook listener component (webhook-listener.php). The flaw is due to improper neutralization of input (CWE-79) in the Stripe webhook event object's 'id' field. When the optional Stripe signing secret is not set, the webhook signature is not verified, allowing attackers to send forged webhook events containing malicious script payloads in the 'id' field. These payloads are stored in the payment log and rendered unsanitized when administrators view payment details, leading to script execution in their browsers. The vulnerability affects all versions up to and including 6.2.4.

This vulnerability allows unauthenticated attackers to perform stored Cross-Site Scripting attacks against administrators by injecting malicious scripts into payment logs via forged Stripe webhook events. Successful exploitation could lead to theft of administrator session cookies, defacement, or other actions performed with administrator privileges. The attack requires knowledge of a valid Stripe PaymentIntent ID to target a specific payment record. There is no indication of active exploitation in the wild at this time.

No official patch or fix link is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. As a mitigation, administrators should ensure the Stripe signing secret is configured to enable webhook signature verification, preventing acceptance of forged webhooks. Until a patch is available, disabling the premium Stripe webhook listener or restricting access to payment logs may reduce risk.