Stored Cross-Site Scripting in WordPress Booking Plugin by Five Star Restaurant
CVE-2025-11496

6.1MEDIUM

Key Information:

Vendor

WordPress
Status
Five Star Restaurant Reservations – WordPress Booking Plugin
Vendor
CVE Published:
21 December 2025

What is CVE-2025-11496?

The Five Star Restaurant Reservations plugin for WordPress has a vulnerability that allows Stored Cross-Site Scripting via the 'rtb-name' parameter. This issue arises from insufficient input sanitization and output escaping, enabling unauthenticated attackers to inject malicious web scripts. These scripts can be executed when users access compromised pages, potentially leading to a range of security threats.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Five Star Restaurant Reservations – WordPress Booking Plugin * <= 2.7.5

References

https://www.wordfence.com/threat-intel/vulnerabilities/id...
https://plugins.trac.wordpress.org/changeset?sfp_email=&s...

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

D.Sim
JSON
.