cve/2022/CVE-2022-0421.md

### [CVE-2022-0421](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0421)
![](https://img.shields.io/static/v1?label=Product&message=Five%20Star%20Restaurant%20Reservations&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=0%3C%202.4.12%20&color=brighgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=CWE-116%20Improper%20Encoding%20or%20Escaping%20of%20Output&color=brighgreen)

### Description

The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping, attackers could perform Cross-Site Scripting attacks against a logged in admin viewing the failed payments

### POC

#### Reference
- https://wpscan.com/vulnerability/145e8d3c-cd6f-4827-86e5-ea2d395a80b9

#### Github
No PoCs found on GitHub currently.