The vulnerability resides in the public REST endpoint that accepts a 'name' parameter which is not sanitized before storage and later output without escaping for users lacking sufficient privileges. As a result, an unauthenticated attacker can submit any JavaScript payload that will be stored in the database and executed in the browser whenever a user opens a bookings page. This allows injection of arbitrary scripts, which can be used for session hijacking, defacement, or delivery of malicious content.

The flaw affects the MotoPress Appointment Booking Lite plugin for WordPress, versions 2.4.8 and earlier. Users running those versions on any WordPress site are potentially vulnerable. No specific OS or other product is required other than the standard WordPress environment.

The CVSS score of 5.4 indicates moderate severity. EPSS is not available, so the likelihood of exploitation cannot be quantified, but the flaw is publicly accessible and does not require authentication, making it low‑effort to exploit. The vulnerability is not listed in CISA’s KEV catalog. Attackers can exploit the endpoint directly without credentials; the vulnerability does not require privileged access, so it is exploitable by anyone who can reach the site’s REST API.