Threats tagged 'ghsa-px2x-7739-98cp'

The MotoPress Appointment Booking Lite plugin for WordPress versions up to and including 2.4.8 is vulnerable to a stored cross-site scripting (XSS) flaw via its public REST endpoint '/motopress/appointment/v1/customers/create'. This endpoint allows unauthenticated attackers to inject arbitrary scripts because the 'name' parameter is not sanitized before database insertion and not escaped on output in the admin bookings list. The vulnerability affects users with limited capabilities, such as the Appointment Employee role, enabling script execution when viewing injected pages.