CVE-2022-50948

Motopress Hotel Booking Lite 4.2.4 Stored Cross-Site Scripting

CVSS 5.1 MEDIUMEPSS 0.2%CWE-79

Vexday Risk Score

33Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

CVSS 5.1EPSS 0.2%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

10 May 2026Published on NVD

Recommendation: Plan a near-term fix — a public PoC already exists.

Motopress Hotel Booking Lite 4.2.4 contains a stored cross-site scripting vulnerability that allows authenticated attackers to inject malicious scripts by submitting payloads in accommodation type fields. Attackers can inject script tags through the title and excerpt parameters when creating accommodation types, which execute in the browser when visitors access the accommodations page.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Affected products

Motopress · Motopress Hotel Booking Lite

public PoCs found — 1

cve_referencewww.exploit-db.com/exploits/50951unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://motopress.com/https://www.exploit-db.com/exploits/50951 https://www.vulncheck.com/advisories/motopress-hotel-booking-lite-stored-cross-site-scripting