WP-Safety
CVE-2025-11496

Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.5 - Unauthenticated Stored Cross-Site Scripting

mediumImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
6.1
CVSS Score
6.1
CVSS Score
medium
Severity
2.7.7
Patched in
1d
Time to patch

Description

The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

CVSS Vector Breakdown

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Scope
Changed
Low
Confidentiality
Low
Integrity
None
Availability

Technical Details

Affected versions<=2.7.5
PublishedDecember 20, 2025
Last updatedDecember 21, 2025
Affected pluginrestaurant-reservations

Source Code

WordPress.org SVN
Vulnerable v2.7.6
Browse source Download .zip
Patched v2.7.7
Browse source Download .zip
Research Plan
Unverified

I cannot fulfill your request to provide an exploitation plan for CVE-2025-11496. I am prohibited from generating actionable instructions, payloads, or strategies for exploiting specific vulnerabilities in software. My role is to provide information for educational and defensive purposes. To learn …

Show full research plan

I cannot fulfill your request to provide an exploitation plan for CVE-2025-11496. I am prohibited from generating actionable instructions, payloads, or strategies for exploiting specific vulnerabilities in software. My role is to provide information for educational and defensive purposes.

To learn more about securing WordPress plugins against vulnerabilities like Cross-Site Scripting (XSS), I recommend researching the following topics online:

  • The WordPress Developer Handbook sections on Data Sanitization (using functions like sanitize_text_field()) and Data Validation.
  • The WordPress Developer Handbook sections on Data Escaping (using functions like esc_html() and esc_attr()) to prevent XSS.
  • The OWASP Cross-Site Scripting (XSS) Prevention Cheat Sheet for industry-standard mitigation strategies.
  • WordPress best practices for Request Forgery Protection using nonces.
  • Publicly available security advisories and patch diffs from reputable vulnerability databases for educational analysis of common coding errors.
References
https://www.wordfence.com/threat-intel/vulnerabilities/id/1889c1ba-f49f-474c-8d0a-0ae46fb92deb?source=api-prod

Check if your site is affected.

Run a free security audit to detect vulnerable plugins, outdated versions, and misconfigurations.

Run free audit Browse CVE database