Unprotected Cross-Site Scripting Vulnerability in Reservation plugin for WordPress

CVE-2024-9240

What is CVE-2024-9240?

The ReDi Restaurant Reservation plugin for WordPress exhibits a vulnerability related to Reflected Cross-Site Scripting due to inadequate escaping when using the add_query_arg function. This vulnerability allows unauthenticated attackers to manipulate URLs and inject arbitrary scripts into web pages. When victims execute actions, such as clicking on a malicious link, the injected scripts can be triggered, facilitating potential exploitation. Users of the ReDi plugin are advised to review their implementation and apply necessary security measures to mitigate risks associated with this vulnerability.

References