What’s Vulnerable › Products
arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System vulnerabilities
13 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.
Latest arraytics WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System vulnerabilities
- CVE-2026-75028 — WPCafe <= 3.0.18 - Authenticated (Contributor+) Local File Inclusion via 'food_menu_style' Elementor Widget Setting (CVSS 7.5)
- CVE-2026-11601 — WPCafe <= 3.0.19 - Missing Authorization to Unauthenticated Arbitrary Email Notification Flow Read/Create/Update/Delete (CVSS 5.3)
- CVE-2026-11818 — WPCafe <= 3.0.14 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Modification via REST API (CVSS 5.4)
- CVE-2026-57622 — WordPress WPCafe plugin <= 3.0.14 - Broken Access Control vulnerability (CVSS 4.3)
- CVE-2026-27071 — WordPress WPCafe plugin <= 3.0.7 - Broken Access Control vulnerability (CVSS 9.1)
- CVE-2025-39452 — WordPress WPCafe plugin <= 2.2.32 - Local File Inclusion vulnerability (CVSS 7.5)
- CVE-2025-30829 — WordPress WPCafe plugin <= 2.2.31 - Local File Inclusion vulnerability (CVSS 7.5)
- CVE-2023-47805 — WordPress WPCafe plugin <= 2.2.22 - Broken Access Control vulnerability (CVSS 9.8)
- CVE-2024-43135 — WordPress WPCafe plugin <= 2.2.28 - Local File Inclusion vulnerability (CVSS 8.8)
- CVE-2024-37513 — WordPress WPCafe plugin <= 2.2.27 - Local File Inclusion vulnerability (CVSS 8.8)
- CVE-2024-5431 — WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.25 - Authenticated (Contributor+) File inclusion via Shortcode (CVSS 8.8)
- CVE-2024-5427 — WPCafe – Online Food Ordering, Restaurant Menu, Delivery, and Reservations for WooCommerce <= 2.2.24 - Authenticated (Contributor+) Stored Cross-Site Scripting via Reservation Form Shortcode (CVSS 5.4)
- CVE-2024-1855 — WPCafe <= 2.2.23 - Unauthenticated Blind Server-Side Request Forgery (CVSS 5.3)