{"id":"CVE-2022-0421","aliases":["EUVD-2022-15563","GHSA-rm3p-6j6m-68q8"],"status":"published","title":"Five Star Restaurant Reservations \u003c 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS","description":"The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00574,"percentile":0.47727,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-116","CWE-79","CWE-862"],"published":"2022-11-21T00:00:00Z","modified":"2026-06-17T04:20:34Z","products":[{"vendor":"fivestarplugins","product":"five_star_restaurant_reservations"},{"vendor":"rustaurius","product":"five star restaurant reservations"},{"vendor":"unknown","product":"five star restaurant reservations"}],"references":[{"url":"https://wpscan.com/vulnerability/145e8d3c-cd6f-4827-86e5-ea2d395a80b9","tags":["exploit","vdb-entry","technical-description","x_transferred","Exploit","Third Party Advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-0421"},{"url":"https://github.com/advisories/GHSA-rm3p-6j6m-68q8"}],"sources":{"cve":[{"id":"CVE-2022-0421","title":"Five Star Restaurant Reservations \u003c 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS","description":"The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments","status":"published","published":"2022-11-21T00:00:00Z","modified":"2025-04-30T14:54:24.956Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"updated_at":"2026-11-02T14:34:41.34666Z"}],"euvd":[{"id":"EUVD-2022-15563","description":"The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments","status":"published","published":"2022-11-21T00:00:00Z","modified":"2025-04-30T14:54:24Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T20:51:59.458406Z"}],"ghsa":[{"id":"GHSA-rm3p-6j6m-68q8","title":"The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation...","description":"The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments","status":"published","published":"2022-11-21T12:30:17Z","modified":"2023-07-04T05:01:36Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79","CWE-116","CWE-862"],"updated_at":"2026-11-02T14:54:40.485503Z"}],"nvd":[{"id":"CVE-2022-0421","description":"The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments","status":"published","published":"2022-11-21T11:15:19.153Z","modified":"2026-06-17T04:20:34.27Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-116"],"updated_at":"2026-11-02T14:07:32.395456Z"}]}}