Plugins · restaurant-reservations · data as of 2026-11-04
Is Five Star Restaurant Reservations safe? Known vulnerabilities and latest version
- Latest version
- 2.9.1
- Last updated
- 2026-10-26
- Active installs
- 10,000+
- Known issues on record
- 16
- Unpatched in latest
- 0
- Tested up to WP
- 7.1.4 · PHP 8.0+
Restaurant reservations made easy. Accept bookings online. Quickly confirm or reject reservations, send email notifications, set booking times and mor … — by Rustaurius
What to do
- Update to the latest version (2.9.1). Anything older than 2.8.0 has at least one known issue listed below. Dashboard → Updates, or Plugins → “update now”.
- If you cannot update right away, deactivate it until you can.
- Turn on auto-updates for it: Plugins → “Enable auto-updates” on its row.
- If you ran a vulnerable version and something looks off (spam pages, strange admins, redirects), run the free scan.
With WP-CLI: wp plugin get restaurant-reservations --field=version shows what you run; wp plugin update restaurant-reservations updates it.
Check your version
Known vulnerabilities
16 on record, newest first. “Affected” is the version range the source gives; “fixed in” is the version the source names, or (marked *) the first wordpress.org release after the last affected version.
high 7.5 CVE-2026-103334 · published 2026-10-05
Information disclosure in Five Star Restaurant Reservations (2.7.24 and older)
- Affected
- 2.7.24 and older
- Fixed in
- 2.8.0
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Insertion of Sensitive Information Into Sent Data vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations restaurant-reservations allows Retrieve Embedded Sensitive Data.This issue affects Five Star Restaurant Reservations: from n/a through 2.7.24.
medium 5.3 CVE-2026-15147 · published 2026-08-06
Missing authorization check in Five Star Restaurant Reservations (older than 2.7.23)
- Affected
- older than 2.7.23
- Fixed in
- 2.7.23
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by WPScan
Details from the advisory
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not verify the authenticity of incoming payment notifications, failing to validate the payment recipient, amount, and status or to bind the notification to the intended booking, allowing unauthenticated attackers to mark arbitrary pending reservations as paid and confirmed.
high 7.5 CVE-2026-15151 · published 2026-08-02
Missing authorization check in Five Star Restaurant Reservations (older than 2.7.23)
- Affected
- older than 2.7.23
- Fixed in
- 2.7.23
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory
The Five Star Restaurant Reservations WordPress plugin before 2.7.23 does not perform a capability check on one of its AJAX actions, allowing users with the lowest booking-management role (which by default cannot access the Five Star Restaurant Reservations WordPress plugin before 2.7.23's settings) to reset the site's configured booking notification rules.
high 7.5 CVE-2026-54830 · published 2026-06-25
Missing authorization check in Five Star Restaurant Reservations (2.7.19 and older)
- Affected
- 2.7.19 and older
- Fixed in
- 2.7.20
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Unauthenticated Broken Access Control in Five Star Restaurant Reservations <= 2.7.19 versions.
high 7.5 CVE-2026-42670 · published 2026-06-02
Missing authorization check in Five Star Restaurant Reservations (2.7.14 and older)
- Affected
- 2.7.14 and older
- Fixed in
- 2.7.15
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory
Missing Authorization vulnerability in Etoile Web Design Incorporated Five Star Restaurant Reservations allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Five Star Restaurant Reservations: from n/a through 2.7.14.
medium 5.3 CVE-2026-6498 · published 2026-04-30
Security issue in Five Star Restaurant Reservations (2.7.16 and older)
- Affected
- 2.7.16 and older
- Fixed in
- 2.7.17 *
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Five Star Restaurant Reservations plugin for WordPress is vulnerable to a payment bypass via PHP type juggling in versions up to, and including, 2.7.16 This is due to the valid_payment() function using a PHP loose comparison (==) between the attacker-controlled payment_id POST parameter and the booking's stripe_payment_intent_id property. When an unauthenticated attacker submits a request to the nopriv AJAX handler rtb_stripe_pmt_succeed before the Stripe payment intent has been created for a booking (i.e., before the JavaScript-triggered create_stripe_pmtIntnt() call has stored an intent ID in post meta), the stripe_payment_intent_id property on the booking object remains null. The comparison sanitize_text_field('') == null evaluates to TRUE in PHP loose comparison, causing the payment verification check to pass with zero actual payment. This makes it possible for unauthenticated attackers to mark any existing payment_pending booking as paid without completing a Stripe payment by submitting an empty payment_id parameter.
NVD CVE-2026-6498Wordfence advisoryCode change (fix)Plugin source
medium 6.5 CVE-2026-25327 · published 2026-03-25
Missing authorization check in Five Star Restaurant Reservations (2.7.9 and older)
- Affected
- 2.7.9 and older
- Fixed in
- 2.7.10
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.9.
medium 4.3 CVE-2026-0658 · published 2026-02-02
Cross-site request forgery (CSRF) in Five Star Restaurant Reservations (older than 2.7.9)
- Affected
- older than 2.7.9
- Fixed in
- 2.7.9
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by CISA ADP
Details from the advisory
The Five Star Restaurant Reservations WordPress plugin before 2.7.9 does not have CSRF checks in some bulk actions, which could allow attackers to make logged in admins perform unwanted actions, such as deleting bookings via CSRF attacks.
high 8.6 CVE-2025-68044 · published 2026-01-05
Missing authorization check in Five Star Restaurant Reservations (2.7.4 and older)
- Affected
- 2.7.4 and older
- Fixed in
- 2.7.5
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.4.
medium 5.4 CVE-2025-68601 · published 2025-12-24
Cross-site request forgery (CSRF) in Five Star Restaurant Reservations (2.7.8 and older)
- Affected
- 2.7.8 and older
- Fixed in
- 2.7.9
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.7.8.
medium 6.1 CVE-2025-11496 · published 2025-12-21
Stored cross-site scripting (XSS) in Five Star Restaurant Reservations (2.7.5 and older)
- Affected
- 2.7.5 and older
- Fixed in
- 2.7.6 *
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by Wordfence
Details from the advisory
The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter in all versions up to, and including, 2.7.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
medium 4.9 CVE-2025-30861 · published 2025-03-27
Missing authorization check in Five Star Restaurant Reservations (2.6.29 and older)
- Affected
- 2.6.29 and older
- Fixed in
- 2.6.30
- Access needed (per CVSS)
- Needs an admin-level account
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations: from n/a through <= 2.6.29.
medium 5.3 CVE-2024-33596 · published 2024-04-29
Missing authorization check in Five Star Restaurant Reservations (2.6.16 and older)
- Affected
- 2.6.16 and older
- Fixed in
- 2.6.17
- Access needed (per CVSS)
- No login needed
- Range from
- CVE record (the advisory publisher) · score by Patchstack
Details from the advisory
Missing Authorization vulnerability in Five Star Plugins Five Star Restaurant Reservations.This issue affects Five Star Restaurant Reservations: from n/a through 2.6.16.
medium 6.1 CVE-2023-34017 · published 2023-07-25
Reflected cross-site scripting (XSS) in Five Star Restaurant Reservations (2.6.7 and older)
- Affected
- 2.6.7 and older
- Fixed in
- 2.6.8
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in FiveStarPlugins Five Star Restaurant Reservations plugin <= 2.6.7 versions.
medium 6.1 CVE-2022-0421 · published 2022-11-21
Cross-site scripting (XSS) in Five Star Restaurant Reservations (older than 2.4.12)
- Affected
- older than 2.4.12
- Fixed in
- 2.4.12
- Access needed (per CVSS)
- No login needed; someone on the site has to click a link or open a page
- Range from
- CVE record (the advisory publisher) · score by NVD
Details from the advisory
The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments
medium 5.4 CVE-2021-24965 · published 2022-01-24
Cross-site request forgery (CSRF) in Five Star Restaurant Reservations (older than 2.4.8)
- Affected
- older than 2.4.8
- Fixed in
- 2.4.8
- Access needed (per CVSS)
- Needs a low-level account (e.g. subscriber); someone on the site has to click a link or open a page
- Range from
- advisory text · score by NVD
Details from the advisory
The Five Star Restaurant Reservations WordPress plugin before 2.4.8 does not have capability and CSRF checks in the rtb_welcome_set_schedule AJAX action, allowing any authenticated users to call it. Due to the lack of sanitisation and escaping, users with a role as low as subscriber could perform Cross-Site Scripting attacks against logged in admins
Recent activity
- 2026-10-26 — latest release on wordpress.org (2.9.1).
- 2026-10-05 — Information disclosure disclosed (CVE-2026-103334), fixed in 2.8.0.
- 2026-08-06 — Missing authorization check disclosed (CVE-2026-15147), fixed in 2.7.23.
- 2026-08-02 — Missing authorization check disclosed (CVE-2026-15151), fixed in 2.7.23.
Get an email when Five Star Restaurant Reservations has a new vulnerability
Free. We check the CVE feeds every day and email you only when a new issue for Five Star Restaurant Reservations (restaurant-reservations) is published or a fix ships. Unsubscribe in one click.
Browse vulnerabilities
- Published this week
- Unpatched in the latest version
- By type of vulnerability
- Plugins by Rustaurius (7 tracked)
Types found in this plugin: Missing authorization (8) · Cross-site request forgery (CSRF) (3) · Cross-site scripting (XSS) (3) · Sensitive data exposure (1)
Where this data comes from
- Version, last update, installs: wordpress.org/plugins/restaurant-reservations (Plugins API), fetched 2026-11-04.
- Vulnerabilities: NIST National Vulnerability Database (NVD), checked 2026-11-04. This product uses data from the NVD API but is not endorsed or certified by the NVD.
- Each record links to its CVE page and to the original advisory (Wordfence, Patchstack or WPScan) where there is one. We only list a CVE here when its references or its advisory name this exact plugin, so a few real issues may be missing; none should be about a different plugin. Spot an error? Email Daniel.
Badge for your site or docs (states facts with a date, not a verdict):
<a href="https://laskyr.com/plugins/restaurant-reservations"><img src="https://laskyr.com/plugins/restaurant-reservations/badge.svg" alt="Five Star Restaurant Reservations vulnerability status"></a>