Ketchup Restaurant Reservations Vulnerabilities

[en] The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise and escape some of the reservation user inputs, allowing unauthenticated attackers to perform Cross-Site Scripting attacks logged in admin viewing the malicious reservation made

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Sep 19, 2022

CVE-2022-2753 on NVD →

[en] The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not validate and escape some reservation parameters before using them in SQL statements, which could allow unauthenticated attackers to perform SQL Injection attacks

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Sep 19, 2022

CVE-2022-2754 on NVD →

The Ketchup Restaurant Reservations plugin for WordPress is vulnerable to blind SQL Injection in versions up to, and including, 1.0.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append a...

CVSS:

9.8

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Sep 6, 2022

CVE-2022-2754 on NVD →

The Ketchup Restaurant Reservations plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.0.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenev...

CVSS:

7.2

Affected:

up to 1.0.0

Fix:

No patched version reported

Disclosed:

Sep 6, 2022

CVE-2022-2753 on NVD →