blogsafe.org My Downloads

BlogSafe.org

WordPress CVEs

Search and review WordPress-related vulnerability records.

← Back to CVE list

CVE-2021-24299

MEDIUM 6.1 CVSS 3.1
Published
May 17, 2021
Last modified
June 17, 2026
NVD status
Modified
Reported by
contact@wpscan.com
Weakness
CWE-79
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.

Affected WordPress components

  • ReDi Restaurant Reservation – Instant Restaurant Booking & Table Reservation System Plugin · redi-restaurant-reservation
    Confirmed match Active
    From 21.0426 (including) to 21.0426 (excluding)
    View on WordPress.org

A confirmed match is backed by the plugin or theme slug. A possible match is based on the product name only and should be verified.

Affected products and versions

  • Reservation Diary ReDi Restaurant Reservation — From 21.0426 (including) to 21.0426 (excluding)
  • catzsoft redi_restaurant_reservation — Before 21.0426

References

  • packetstormsecurity.com http://packetstormsecurity.com/files/162756/WordPress-ReDi-Restaurant-Reservation-21.0307-Cross-Site-Scripting.html Exploit, Third Party Advisory
  • wpscan.com https://wpscan.com/vulnerability/fd6ce00b-8c5f-4180-b648-f47b37303670 Exploit, Third Party Advisory
  • nvd.nist.gov Official NVD record