CVE-2021-24299: ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)
Reservation Diary · ReDi Restaurant Reservation
Fixed in 21.0426 · Affected: Reservation Diary ReDi Restaurant Reservation before 21.0426 · Exploitation: possible (1 to 10%)
Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.
Percentile not published
Not scored yet. The CVE record carries no CVSS score.
DescriptionCVE.org
The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.
Affected products1
From the CVE record. A product or version that is not listed is unknown, not unaffected.
- Reservation Diary · ReDi Restaurant Reservationfrom 21.0426 before 21.0426
On the Atlas
Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.
- Exploitation
- Possible (1 to 10%). EPSS between 1% and 10%.
- CISA KEV
- Not listed
- Public check
- No public nuclei template
- Weakness
- Cross-site Scripting
- Vendor
- Reservation Diary
- Published
- May 2021
CoverageNo articles yet
No CyberSIXT article names CVE-2021-24299 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.