Advisories · Technology

jetmonsters MotoPress Hotel Booking.

Every CVE that names jetmonsters MotoPress Hotel Booking among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2026-90650 CVE record

CVSS 7.2 High

MotoPress Hotel Booking <= 6.2.4 - Unauthenticated Stored Cross-Site Scripting via Stripe Webhook Event Object 'id'
- jetmonsters MotoPress Hotel Booking
- Cross-site scripting (XSS)
Not analysed yet 15 Sept 2026
CVE-2026-8684 CVE record

CVSS 5.3 Medium

MotoPress Hotel Booking <= 6.0.1 - Missing Authorization to Unauthenticated Arbitrary Booking Notes Modification via mphb_update_booking_notes AJAX Action
- jetmonsters MotoPress Hotel Booking
- Broken access control
Not analysed yet 22 May 2026
CVE-2024-4413 CVE record

CVSS 9.8 CriticalCritical · CVSS 9+

Hotel Booking Lite <= 4.11.1 - Unauthenticated PHP Object Injection
- jetmonsters MotoPress Hotel Booking
- Insecure deserialization
Not analysed yet 10 May 2024