6.1
Medium
CVE-2022-0421 The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a…
Description
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Five Star Restaurant Reservations 2.4 | earliest → < 2.4.12 | 2.4.12 |
Other CVEs of Five Star Restaurant Reservations
The 4 CVEs of Five Star Restaurant Reservations →
CVE-2026-15147
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming…
5.3
Medium
CVE-2026-15151
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of…
7.5
High
CVE-2026-0658
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions,…
4.3
Medium