Vulnerability · Published Oct 1, 2026 · Assigned by WPScan
CVE-2026-92412Five Star Restaurant Reviews < 2.3.14 - Reflected XSS
High 7.1
In plain English
A high-severity cross-site scripting in Five Star Restaurant Reviews from Unknown. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities).
Severity (CVSS 3.1)7.1High
Exploit odds (30 days)0.2%top 94.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Unknown | Five Star Restaurant Reviews | 0 – before 2.3.14 |
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
References
- https://wpscan.com/vulnerability/90713b84-9c19-46fe-a4ef-89cb9f66ce68/ exploit, vdb-entry, technical-description