6.1
Moyenne
CVE-2022-0421 The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a…
Description
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Five Star Restaurant Reservations 2.4 | premières → < 2.4.12 | 2.4.12 |
Autres CVE de Five Star Restaurant Reservations
Les 4 CVE de Five Star Restaurant Reservations →
CVE-2026-15147
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming…
5.3
Moyenne
CVE-2026-15151
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of…
7.5
Élevée
CVE-2026-0658
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions,…
4.3
Moyenne