CVE-2022-0421: Fivestarplugins Five Star Restaurant Reservations

Medium severity, CVSS 6.1. EPSS: 0.6% chance of exploitation in the next 30 days.

The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments

Affected products

• Fivestarplugins Five Star Restaurant Reservations: before 2.4.12 (fixed in 2.4.12)

Published 2022-11-21. Last modified 2026-06-17.