The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
References
Link | Resource |
---|---|
https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/settings/settings.php | Patch Third Party Advisory |
https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk | Patch Third Party Advisory |
https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd8a6a4-9159-480f-abe2-71972585217b | Third Party Advisory |
Configurations
History
07 Feb 2023, 19:12
Type | Values Removed | Values Added |
---|---|---|
CPE | cpe:2.3:a:thingsforrestaurants:quick_restaurant_menu:*:*:*:*:*:wordpress:*:* | |
First Time |
Thingsforrestaurants
Thingsforrestaurants quick Restaurant Menu |
|
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 4.8 |
References | (MISC) https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk - Patch, Third Party Advisory | |
References | (MISC) https://www.wordfence.com/threat-intel/vulnerabilities/id/cfd8a6a4-9159-480f-abe2-71972585217b - Third Party Advisory | |
References | (MISC) https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/settings/settings.php - Patch, Third Party Advisory |
27 Jan 2023, 21:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2023-01-27 21:15
Updated : 2023-12-10 14:48
NVD link : CVE-2023-0553
Mitre link : CVE-2023-0553
CVE.ORG link : CVE-2023-0553
JSON object : View
Products Affected
thingsforrestaurants
- quick_restaurant_menu
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')