Vulnerabilities

TI-2025-11375 CVE-2025-12399 · GHSA-76x3-974v-wx5g

Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload

LOW 35

The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the /wp-json/srr/v1/app/upload/file REST endpoint in all versions up to,…

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.0069 Published 2025-11-08 No fix listed CWE-434

TI-2024-12422 CVE-2024-13380

Cross-site scripting in alexreservations Alex Reservations: Smart Restaurant Booking

LOW 28

The Alex Reservations: Smart Restaurant Booking plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'rr_form' shortcode in all versions up to, and including, 2.0.5 due to insufficient input…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00341 Published 2025-01-30 No fix listed CWE-79

Vulnerabilities

Filters

Alex Reservations: Smart Restaurant Booking <= 2.2.3 - Authenticated (Admin+) Arbitrary File Upload

Cross-site scripting in alexreservations Alex Reservations: Smart Restaurant Booking