CVE-2025-11496
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The Five Star Restaurant Reservations – WordPress Booking Plugin is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter in all versions up to and including 2.7.5 due to insufficient input sanitization and output escaping.
Risk Assessment
Unauthenticated attackers can inject arbitrary web scripts into pages that will execute whenever a user accesses an injected page, potentially leading to session theft or actions on behalf of the user.
Recommendation
Update the Five Star Restaurant Reservations plugin to a version later than 2.7.5.
Other vulnerabilities in Five Star Restaurant Reservations
See all- CVE-2026-103334High
Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24.
- CVE-2026-15147Medium
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking. This allows unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
- CVE-2026-54830High
The Five Star Restaurant Reservations plugin version 2.7.19 and earlier contains a vulnerability allowing unauthenticated attackers to bypass access controls. This flaw enables unauthorized access to reservation functions without required authentication.
- CVE-2026-42670High
Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.
- CVE-2025-68601Medium
A Cross-Site Request Forgery (CSRF) vulnerability in the Rustaurius Five Star Restaurant Reservations WordPress plugin (restaurant-reservations). This issue affects Five Star Restaurant Reservations versions from n/a through 2.7.8.
Original NVD description (English source)
The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS