RestroPress vulnerabilities

The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart. This allows unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.

The RestroPress WordPress plugin through version 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.

Stored XSS vulnerability in RestroPress (WordPress plugin) allows an attacker to inject malicious script into the page, which executes in the user's browser. Affects versions up to and including 3.2.8.6.