¿Es seguro Menu Ordering Reservations?

Qué hace este plugin

• Slug: menu-ordering-reservations
• 8000+ instalaciones activas

food menufood orderfood orderingrestaurant menurestaurant reservation

Estado de mantenimiento

• Última versión conocida: 2.4.4
• Requiere PHP: 5.5.0+
• PHP máximo soportado (analizado): 8.4

Vulnerabilidades conocidas

7 CVEs conocidos registrados para Menu Ordering Reservations. Reportadas entre 2022 y 2024.

CVE-2024-9653

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'action' parameter in all versions up to, and including, 2.4.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-1399

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2024-32579

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 2.4.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2023-32516

Update the WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin to the latest available version (at least 2.3.7). Le Ngoc Anh discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Restaurant Menu – Food Ordering System – Table Reservation Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.3.7.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Restaurant Menu – Food Ordering System – Table Reservation [menu-ordering-reservations] < 2.3.7

The Menu - Ordering - Reservations plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘redirect’ parameter in versions up to, and including, 2.3.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

CVE-2022-4657

The Restaurant Menu WordPress plugin before 2.3.6 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Restaurant Menu – Food Ordering System – Table Reservation [menu-ordering-reservations] < 2.3.6

Update the WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin to the latest available version (at least 2.3.6). WordfenceTeam discovered and reported this Cross Site Scripting (XSS) vulnerability in WordPress Restaurant Menu – Food Ordering System – Table Reservation Plugin. This could allow a malicious actor to inject malicious scripts, such as redirects, advertisements, and other HTML payloads into your website which will be executed when guests visit your site. This vulnerability has been fixed in version 2.3.6.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Patchstack

Restaurant Menu – Food Ordering System – Table Reservation [menu-ordering-reservations] < 2.3.6

The Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in versions up to, and including, 2.3.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers with contributor level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: Wordfence

+ 2 vulnerabilidades conocidas más

CVE	Vulnerabilidad	Tipo	Gravedad	Afectadas	Corregido en	Publicado	Estado
CVE-2022-2696	Restaurant Menu – Food Ordering System – Table Reservation [menu-ordering-reservations] < 2.3.2	Falta de control de autorización	Media 6,5	< 2.3.2	2.3.2	2022-10-31	✓ corregido en la última versión
CVE-2022-3776	Restaurant Menu – Food Ordering System – Table Reservation [menu-ordering-reservations] < 2.3.2	Falsificación de petición en sitios cruzados (CSRF)	Alta 8,8	< 2.3.2	2.3.2	2022-10-31	✓ corregido en la última versión

CVE-2022-2696

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to authorization bypass via several AJAX actions in versions up to, and including 2.3.0 due to missing capability checks and missing nonce validation. This makes it possible for authenticated attackers with minimal permissions to perform a wide variety of actions such as modifying the plugin's settings and modifying the ordering system preferences.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

CVE-2022-3776

The Restaurant Menu – Food Ordering System – Table Reservation plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.3.1. This is due to missing or incorrect nonce validation on several functions called via AJAX actions such as forms_action, set_option, & chosen_options to name a few . This makes it possible for unauthenticated attackers to perform a variety of administrative actions like modifying forms, via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

Descripción técnica mostrada en el idioma original de la fuente (inglés).

Fuente: CVE.org

Cómo solucionarlo

Mantén Menu Ordering Reservations actualizado — 2.4.4 es la última versión en wordpress.org, y cada CVE de arriba indica la versión exacta que lo corrigió ("Corregido en").

Este es el historial completo de vulnerabilidades conocidas del plugin, no un escaneo de una instalación específica — ejecuta un escaneo gratis de tu propio sitio para verificar tu versión instalada exacta.

Alternativas más seguras / más establecidas

• WPCafe – Restaurant Menu, Online Food Ordering & Table Booking System — 5000+ instalaciones activas — 92/100 (105) — PHP máx. <8.0
• Orderable – Restaurant & Food Ordering System — 5000+ instalaciones activas — 92/100 (40) — PHP máx. 8.4
• Five Star Restaurant Menu and Food Ordering — 5000+ instalaciones activas — 92/100 (107) — PHP máx. <8.0
• Food Menu – Restaurant Menu & Online Ordering for WooCommerce — 3000+ instalaciones activas — 100/100 (23)
• Restaurant Menu and Food Ordering — 2000+ instalaciones activas — 90/100 (15)