CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-33596 – WordPress Five Star Restaurant Reservations plugin <= 2.6.16 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-33596
Missing Authorization vulnerability in Five Star Plugins Five Star Restaurant Reservations.This issue affects Five Star Restaurant Reservations: from n/a through 2.6.16. Vulnerabilidad de autorización faltante en Five Star Plugins Five Star Restaurant Reservations. Este problema afecta a las Reservas de restaurantes Five Star: desde n/a hasta 2.6.16. The Five Star Restaurant Reservations plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on several functions in versions up to, and including, 2.6.16. This makes it possible for unauthenticated attackers to perform unauthorized actions. • https://patchstack.com/database/vulnerability/restaurant-reservations/wordpress-five-star-restaurant-reservations-plugin-2-6-16-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2023-51403 – WordPress Restaurant Reservations Plugin <= 1.8 is vulnerable to Cross Site Scripting (XSS)
https://notcve.org/view.php?id=CVE-2023-51403
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Nicdark Restaurant Reservations allows Stored XSS.This issue affects Restaurant Reservations: from n/a through 1.8. La vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web ('cross-site Scripting') en Nicdark Restaurant Reservations permite almacenar XSS. Este problema afecta a Restaurant Reservations: desde n/a hasta 1.8. The Restaurant Reservations plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.8 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/nd-restaurant-reservations/wordpress-restaurant-reservations-plugin-1-8-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2753 – Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Stored XSS
https://notcve.org/view.php?id=CVE-2022-2753
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made El plugin Ketchup Restaurant Reservations de WordPress versiones hasta 1.0.0, no comprueba y escapa de algunas de las entradas del usuario de la reserva, permitiendo a atacantes no autenticados llevar a cabo ataques de tipo Cross-Site Scripting al entrar como administrador visualizando la reserva maliciosa realizada The Ketchup Restaurant Reservations plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://wpscan.com/vulnerability/3c6cc46e-e18a-4f34-ac09-f30ca74a1182 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2754 – Ketchup Restaurant Reservations <= 1.0.0 - Unauthenticated Blind SQLi
https://notcve.org/view.php?id=CVE-2022-2754
The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using them in SQL statements, which could allow unauthenticated attackers to perform SQL Injection attacks El plugin Ketchup Restaurant Reservations de WordPress versiones hasta 1.0.0, no comprueba ni escapa de algunos parámetros de reserva antes de usarlos en sentencias SQL, lo que podría permitir a atacantes no autenticados llevar a cabo ataques de inyección SQL The Ketchup Restaurant Reservations plugin for WordPress is vulnerable to blind SQL Injection in versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://wpscan.com/vulnerability/e3c6d137-ff6e-432a-a21a-b36dc81f73c5 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-15819 – ND Restaurant Reservations <= 1.3 - Options Change
https://notcve.org/view.php?id=CVE-2019-15819
The nd-restaurant-reservations plugin before 1.5 for WordPress has no requirement for nd_rst_import_settings_php_function authentication. El plugin nd-restaurant-reservations anterior de la versión 1.5 para WordPress no tiene ningún requisito para la autenticación nd_rst_import_settings_php_function. The ND Restaurant Reservations plugin before 1.5 for WordPress is vulnerable to unauthenticated option changes via the nd_rst_import_settings_php_function. This allows unauthenticated attackers to change arbitrary site options, including options that can allow site takeover, such as setting the default role to administrator. • https://blog.nintechnet.com/privilege-escalation-vulnerability-in-wordpress-nd-restaurant-reservations-plugin https://wordpress.org/plugins/nd-restaurant-reservations/#developers https://wpvulndb.com/vulnerabilities/9501 • CWE-306: Missing Authentication for Critical Function CWE-862: Missing Authorization •