Wppizza Vulnerabilities

The WPPizza – A Restaurant Plugin plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 3.19.9. This makes it possible for authenticated attackers, with Subscriber-level access and above, to extract sensitive user or configuration data.

CVSS:

4.3

Affected:

up to 3.19.9

Fixed in:

3.20

Disclosed:

Apr 29, 2026

CVE-2026-40796 on NVD →

The WPPizza – A Restaurant Plugin plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 3.19.8. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform an unauthorized action.

CVSS:

4.3

Affected:

up to 3.19.8

Fixed in:

3.19.8.1

Disclosed:

Aug 22, 2025

CVE-2025-57894 on NVD →

[en] Missing Authorization vulnerability in ollybach WPPizza allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPPizza: from n/a through 3.19.8.

Affected:

up to 3.19.8.1

Fixed in:

3.19.8.1

Disclosed:

Aug 22, 2025

CVE-2025-57894 on NVD →

[en] Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ollybach WPPizza allows Reflected XSS. This issue affects WPPizza: from n/a through 3.19.4.

Affected:

up to 3.19.5

Fixed in:

3.19.5

Disclosed:

Feb 25, 2025

CVE-2025-26991 on NVD →

The WPPizza plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.19.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick...

CVSS:

6.1

Affected:

up to 3.19.4

Fixed in:

3.19.5

Disclosed:

Feb 23, 2025

CVE-2025-26991 on NVD →

[en] Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in ollybach WPPizza allows Reflected XSS.This issue affects WPPizza: from n/a through 3.18.13.

Affected:

up to 3.18.14

Fixed in:

3.18.14

Disclosed:

Jun 21, 2024

CVE-2024-35766 on NVD →

The WPPizza – A Restaurant Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in all versions up to, and including, 3.18.13 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if t...

CVSS:

6.1

Affected:

up to 3.18.13

Fixed in:

3.18.14

Disclosed:

Jun 18, 2024

CVE-2024-35766 on NVD →

[en] Missing Authorization vulnerability in Ollybach WPPizza.This issue affects WPPizza: from n/a through 3.18.10.

Affected:

up to 3.18.11

Fixed in:

3.18.11

Disclosed:

May 6, 2024

CVE-2024-33576 on NVD →

The WPPizza plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the admin_ajax function found in several files in versions up to, and including, 3.18.10. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify several...

CVSS:

4.3

Affected:

up to 3.18.10

Fixed in:

3.18.11

Disclosed:

Apr 25, 2024

CVE-2024-33576 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ollybach WPPizza – A Restaurant Plugin plugin <= 3.18.2 versions.

Affected:

up to 3.18.3

Fixed in:

3.18.3

Disclosed:

Oct 31, 2023

CVE-2023-46622 on NVD →

The WPPizza plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the use of PHP_SELF in versions up to, and including, 3.18.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they...

CVSS:

6.1

Affected:

up to 3.18.2

Fixed in:

3.18.3

Disclosed:

Oct 25, 2023

CVE-2023-46622 on NVD →

[en] Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in ollybach WPPizza – A Restaurant Plugin plugin <= 3.17.1 versions.

Affected:

up to 3.17.2

Fixed in:

3.17.2

Disclosed:

Aug 18, 2023

CVE-2023-32105 on NVD →

The WPPizza plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via multiple GET parameters in versions up to, and including, 3.17.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...

CVSS:

6.1

Affected:

up to 3.17.1

Fixed in:

3.17.2

Disclosed:

May 3, 2023

CVE-2023-32105 on NVD →

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Update the plugin.

Affected:

up to 2.11.8.18

Fixed in:

2.11.8.18

Disclosed:

May 14, 2015

Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

CVSS:

6.1

Affected:

up to 2.11.8.18

Fixed in:

2.11.8.18

Disclosed:

Aug 1, 2014

CVE-2013-6837 on NVD →

[en] Cross-site scripting (XSS) vulnerability in the setTimeout function in js/jquery.prettyPhoto.js in prettyPhoto 3.1.4 and earlier allows remote attackers to inject arbitrary web script or HTML via a crafted PATH_INTO to the default URI.

Affected:

up to 2.11.8.18

Fixed in:

2.11.8.18

Disclosed:

Dec 19, 2013

CVE-2013-6837 on NVD →