CVE-2021-24299: ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)
The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2021-24299?
CVE-2021-24299 is considered to have a medium severity due to the potential for unauthenticated cross-site scripting (XSS) attacks.
How do I fix CVE-2021-24299?
To mitigate CVE-2021-24299, update the ReDi Restaurant Reservation plugin to version 21.0426 or later.
Who is affected by CVE-2021-24299?
CVE-2021-24299 affects WordPress sites using the ReDi Restaurant Reservation plugin versions prior to 21.0426.
What type of vulnerability is CVE-2021-24299?
CVE-2021-24299 is a cross-site scripting (XSS) vulnerability that allows attackers to inject malicious scripts.
Can existing users exploit CVE-2021-24299?
Yes, even unauthenticated users can exploit CVE-2021-24299 to perform XSS attacks if proper mitigation measures are not enforced.