Stored Cross-Site Scripting in WordPress Booking Plugin by Five Star Restaurant
CVE-2025-11496
6.1MEDIUM
Key Information:
- Vendor
WordPress
- Vendor
- CVE Published:
- 21 December 2025
What is CVE-2025-11496?
The Five Star Restaurant Reservations plugin for WordPress has a vulnerability that allows Stored Cross-Site Scripting via the 'rtb-name' parameter. This issue arises from insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject malicious web scripts. These scripts can be executed when users access compromised pages, potentially leading to a range of security threats.
Affected Version(s)
Five Star Restaurant Reservations – WordPress Booking Plugin * <= 2.7.5