WordSec
WordSec

WPCafe – Food Menu, WooCommerce Food Ordering, Food Delivery, Pickup and Restaurant Reservation <= 2.1.4 - Cross-Site Scripting

2022-08-06 00:00
Anonymous

Strategic Overview

Status
Patched in 2.2.0
Affected PluginWPCafe – Restaurant Menu, Online Food Ordering & Table Booking System
Affected Version<= 2.1.4
CVSS7.2High
CVEN/A
View all WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System vulnerabilities

Vulnerability Overview

The WPCafe – Food Menu, WooCommerce Food Ordering, Food Delivery, Pickup and Restaurant Reservation plugin for WordPress is vulnerable to Cross-Site Scripting in versions up to, and including 2.1.4 due to insufficient input sanitization and output escaping on the wpc_location_id parameter. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Technical Analysis

REMEDIATION: Update to version 2.2.0, or a newer patched version --- IDENTIFIER: CWE-79 (Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')) The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

External References

https://www.wordfence.com/threat-intel/vulnerabilities/id/b49ae7fc-e860-4387-b596-12640ec7277f

Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C