Vulnerabilities

TI-2022-00345 CVE-2022-0421 · GHSA-rm3p-6j6m-68q8

Five Star Restaurant Reservations < 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS

MEDIUM 60

The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of ar…

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00574 Published 2022-11-21 Fixed in 2.4.12 CWE-116

TI-2021-07244 CVE-2021-24965 · GHSA-fvjh-pxch-48xx

Five Star Restaurant Reservations < 2.4.8 - Subscriber+ Stored Cross-Site Scripting

LOW 25

The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allowing any authenticated users to call it.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00607 Published 2022-01-24 Fixed in 2.4.8 CWE-79

Vulnerabilities

Filters

Five Star Restaurant Reservations < 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS

Five Star Restaurant Reservations < 2.4.8 - Subscriber+ Stored Cross-Site Scripting