Read the docs
TI-2021-06591 Aliases CVE-2021-24299GHSA-7v76-9gr6-p8jh

ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)

Priority LOW 36CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Cross-site scripting
Confidentiality · integrity · availability
Low · Low · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA. Impact type from CWE-79.

Summary

The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.

Why it matters now

EPSS 0.05501 92nd percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed ReDi Restaurant Reservation (Reservation Diary): 21.0426

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Reservation DiaryReDi Restaurant Reservation21.0426 to before 21.042621.0426Patch availableCNA
  • ReDi Restaurant Reservation VendorReservation Diary Affected 21.0426 to before 21.0426 Fixed in 21.0426 Patch available CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:catzsoft:redi_restaurant_reservation:*:*:*:*:*:wordpress:*:*before 21.0426VulnerableCatzsoft
  • cpe:2.3:a:catzsoft:redi_restaurant_reservation:*:*:*:*:*:wordpress:*:* Versions before 21.0426 Vulnerable ·Catzsoft

Remediation

  • Fix · CNA ReDi Restaurant Reservation (Reservation Diary) Fixed in 21.0426

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-24299
  2. 2026-10-03 Alias added: GHSA-7v76-9gr6-p8jh

References

Exploit 2

  • TI-2023-18349 WordPress ReDi Restaurant Reservation plugin <= 23.0211 - Broken Access Control vulnerability CVSS 3.1HIGH 7.3
  • TI-2024-20675 WordPress ReDi Restaurant Reservation plugin <= 24.0128 - Cross Site Request Forgery (CSRF) to XSS vulnerability CVSS 3.1HIGH 7.1
  • TI-2024-19582 WordPress ReDi Restaurant Reservation plugin <= 24.0128 - Reflected Cross Site Scripting (XSS) vulnerability CVSS 3.1HIGH 7.1
  • TI-2024-25971 WordPress ReDi Restaurant Reservation plugin <= 24.0422 - Broken Access Control vulnerability CVSS 3.1MEDIUM 5.4
  • TI-2024-20757 WordPress ReDi Restaurant Reservation plugin <= 24.0128 - Cross Site Request Forgery (CSRF) vulnerability CVSS 3.1MEDIUM 4.3

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences