Mp Restaurant Menu Vulnerabilities

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 2.4.11. This makes it possible for unauthenticated attackers to include and execute arbitrary files on the server, allowing the execution of any PHP code in those files. This can be use...

CVSS:

8.1

Affected:

up to 2.4.11

Fix:

No patched version reported

Disclosed:

Aug 18, 2026

CVE-2026-73400 on NVD →

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 2.4.10 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributo...

CVSS:

6.5

Affected:

up to 2.4.10

Fixed in:

2.4.11

Disclosed:

Jun 26, 2026

CVE-2026-57644 on NVD →

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 2.4.11. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 2.4.11

Fix:

No patched version reported

Disclosed:

Jun 26, 2026

CVE-2025-63078 on NVD →

[en] Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Retrieve Embedded Sensitive Data.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.7.

Affected:

up to 2.4.7

Fix:

No patched version reported

Disclosed:

Dec 18, 2025

CVE-2025-49914 on NVD →

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.4.7. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

CVSS:

4.3

Affected:

up to 2.4.7

Fixed in:

2.4.8

Disclosed:

Nov 9, 2025

CVE-2025-49914 on NVD →

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.4.6. This is due to missing or incorrect nonce validation on a function. This makes it possible for unauthenticated attackers to perform an unauthorized action granted they can...

CVSS:

4.3

Affected:

up to 2.4.6

Fixed in:

2.4.7

Disclosed:

Jul 16, 2025

CVE-2025-54038 on NVD →

[en] Cross-Site Request Forgery (CSRF) vulnerability in jetmonsters Restaurant Menu by MotoPress allows Cross Site Request Forgery. This issue affects Restaurant Menu by MotoPress: from n/a through 2.4.6.

Affected:

up to 2.4.7

Fixed in:

2.4.7

Disclosed:

Jul 16, 2025

CVE-2025-54038 on NVD →

The Restaurant Menu by MotoPress plugin for WordPress is vulnerable to Local File Inclusion in versions up to, and including, 2.4.4. This makes it possible for authenticated attackers, with contributor-level access and above, to include and execute arbitrary files on the server, allowing the execution of any PHP code i...

CVSS:

8.8

Affected:

up to 2.4.4

Fixed in:

2.4.5

Disclosed:

Mar 27, 2025

CVE-2025-30846 on NVD →

[en] Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPress allows PHP Local File Inclusion. This issue affects Restaurant Menu by MotoPress: from n/a through 2.4.4.

Affected:

up to 2.4.5

Fixed in:

2.4.5

Disclosed:

Mar 27, 2025

CVE-2025-30846 on NVD →

[en] The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

Affected:

up to 2.4.2

Fixed in:

2.4.2

Disclosed:

Nov 1, 2021

CVE-2021-24722 on NVD →

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS:

5.5

Affected:

up to 2.4.2

Fixed in:

2.4.2

Disclosed:

Sep 28, 2021

CVE-2021-24722 on NVD →