CVE-2022-2753

Deeper analysis

The Ketchup Restaurant Reservations WordPress plugin through version 1.0.0 contains a cross-site scripting vulnerability (CWE-79) because it fails to sanitize or escape certain reservation fields submitted by users. The affected component is the plugin's reservation handling logic, which stores and later displays these inputs to administrators without proper output encoding.

An unauthenticated attacker can submit a reservation containing malicious JavaScript payloads. When an administrator views the reservation in the WordPress dashboard, the script executes in the admin's browser context, enabling actions such as session hijacking or unauthorized configuration changes under the reflected privileges.

The EPSS score for this issue has remained flat at 0.1553 with no material increase after disclosure. The referenced WPScan advisory provides the primary public details on the flaw but does not include additional exploitation or mitigation data beyond the initial report.