CVE-2021-24965: Five Star Restaurant Reservations < 2.4.8 - Subscriber+ Stored Cross-Site Scripting

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2022-01-24 · updated 2026-06-17
Weakness: CWE-79

Description

The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allowing any authenticated users to call it. Due to the lack of sanitisation and escaping, users with a role as low as subscriber could perform Cross-Site Scripting attacks against logged in admins

Affected products

Five Star Restaurant Reservations: before 2.4.8 — fixed in 2.4.8

How to fix

Upgrade to a fixed version: Five Star Restaurant Reservations 2.4.8. Check the vendor advisory for mitigations.

References

Get alerted when CVE-2021-24965 or the next vulnerability affects your stack