Rustaurius
33 CVEs across 14 Rustaurius products. Browse Rustaurius vulnerabilities, severities, and proof-of-concept exploits.
Rustaurius products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-27436 | Critical | 9.1 | 2026-07-02 | Editor Arbitrary Code Execution in Five Star Business Profile and Schema <= 2.3.19 versions. |
CVE-2026-54835 | High | 7.5 | 2026-06-26 | Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions. |
CVE-2026-6498 | Medium | 5.3 | 2026-04-30 | The Five Star Restaurant Reservations plugin for WordPress is vulnerable to a payment bypass via PHP type juggling in versions up to, and including, 2.7.16 Thi… |
CVE-2026-4336 | Medium | 6.4 | 2026-04-09 | The Ultimate FAQ Accordion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via FAQ content in all versions up to, and including, 2.4.7. This… |
CVE-2026-39602 | Medium | 5.3 | 2026-04-08 | Missing Authorization vulnerability in Rustaurius Order Tracking order-tracking allows Exploiting Incorrectly Configured Access Control Security Levels.This is… |
CVE-2026-25327 | Medium | 6.5 | 2026-03-25 | Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Con… |
CVE-2026-24634 | Medium | 5.3 | 2026-01-23 | Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Exploiting Incorrectly Configured Access… |
CVE-2025-68044 | High | 8.6 | 2026-01-05 | Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorr… |
CVE-2025-68601 | Medium | 5.4 | 2025-12-24 | Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Cross Site Request Forgery.This… |
CVE-2025-11496 | Medium | 6.1 | 2025-12-21 | The Five Star Restaurant Reservations – WordPress Booking Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'rtb-name' parameter… |
CVE-2025-67590 | Medium | 4.3 | 2025-12-09 | Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate FAQ ultimate-faqs allows Cross Site Request Forgery.This issue affects Ultimate FAQ: fro… |
CVE-2025-11799 | Medium | 6.4 | 2025-11-21 | The Affiliate AI Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'asin' shortcode attribute in the affiai_img shortcode in all v… |
CVE-2025-62072 | Medium | 4.3 | 2025-10-22 | Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through <= 3.2.33. |
CVE-2025-58235 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows St… |
CVE-2025-53454 | Medium | 6.5 | 2025-09-22 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Store… |
CVE-2025-6993 | High | 7.5 | 2025-07-16 | The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the get_email_log_details() AJAX handler i… |
CVE-2025-49266 | High | 7.1 | 2025-06-17 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Refle… |
CVE-2025-49288 | High | 8.8 | 2025-06-06 | Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a… |
CVE-2025-47580 | Medium | 5.4 | 2025-05-15 | Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users allows Exploiting Incorrectly Configured Access Control Security Levels… |
CVE-2025-47490 | High | 8.5 | 2025-05-07 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows SQL I… |
CVE-2025-47466 | Medium | 5.4 | 2025-05-07 | Cross-Site Request Forgery (CSRF) vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Cross Site Request Forgery.This issue affects Ultimate W… |
CVE-2025-32694 | Medium | 4.7 | 2025-04-09 | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Phishing.This issue affects Ultimate W… |
CVE-2025-2005 | Critical | 9.8 | 2025-04-02 | The Front End Users plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the file uploads field of the registrat… |
CVE-2024-12410 | Medium | 4.9 | 2025-04-02 | The Front End Users plugin for WordPress is vulnerable to SQL Injection via the 'UserSearchField' parameter in all versions up to, and including, 3.2.32 due to… |
CVE-2025-30861 | Medium | 4.9 | 2025-03-27 | Missing Authorization vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Con… |
CVE-2025-26877 | Medium | 6.5 | 2025-02-25 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Front End Users front-end-only-users allows St… |
CVE-2024-13563 | Medium | 6.4 | 2025-02-15 | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's forgot-password shortcode in all versions up to, and inc… |
CVE-2024-7607 | High | 8.8 | 2024-08-29 | The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due t… |
CVE-2024-7606 | Medium | 6.4 | 2024-08-29 | The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versions up to, and inclu… |
CVE-2024-5459 | Medium | 4.3 | 2024-06-05 | The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to unauthorized creation of data due to a missing capability check on 'add_section', '… |
CVE-2023-4500 | Medium | 4.7 | 2023-08-31 | The Order Tracking Pro plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the order status parameter in versions up to, and including, 3.3.6… |
CVE-2023-4471 | Medium | 6.1 | 2023-08-31 | The Order Tracking Pro plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the start_date and end_date parameters in versions up to, and i… |
CVE-2020-36726 | Critical | 9.8 | 2023-06-07 | The Ultimate Reviews plugin for WordPress is vulnerable to PHP Object Injection in versions up to, and including, 2.1.32 via deserialization of untrusted input… |