Motopress Hotel Booking Lite version 4.2.4 includes a stored cross-site scripting flaw that permits authenticated administrators to embed malicious script payloads through the title and excerpt fields of accommodation types. When these data are displayed on the public accommodations page, the script runs in the visitor's browser.

The vulnerability affects the Motopress Hotel Booking Lite plugin (WordPress) with an installable version of 4.2.4. Only installations corresponding to this version and its components are impacted.

The CVSS score of 5.1 indicates a moderate severity, and the EPSS score is currently not available, suggesting limited publicly known exploitation attempts. The flaw requires authentication to the WordPress administrative interface, so the likelihood of exploitation is contingent on the presence of vulnerable credentials. The vulnerability is not listed in the CISA KEV catalog, so there is no evidence of large‑scale exploitation at present. A likely attack vector involves an attacker with valid admin credentials submitting crafted title or excerpt content via the plugin’s admin UI, which is then stored and rendered to public users.