WordPress Plugin Vulnerabilities
Five Star Restaurant Reviews < 2.3.14 - Reflected XSS
Description
The plugin does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.
Proof of Concept
Affects Plugins
Fixed in 2.3.14 References
CVE
Classification
Type
XSS
OWASP top 10
CWE
CVSS
Miscellaneous
Original Researcher
V1T
Submitter
V1T
Submitter website
Verified
Yes
WPVDB ID
Timeline
Publicly Published
2026-09-29 (about 2 days ago)
Added
2026-09-29 (about 1 day ago)
Last Updated
2026-09-29 (about 1 day ago)
