high7.1
CVE-2026-92412
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing …
Impact
The Five Star Restaurant Reviews WordPress plugin before 2.3.14 does not properly escape a user-supplied value before outputting it into an HTML tag, allowing unauthenticated attackers to inject arbitrary web script that runs in the browser of anyone tricked into submitting a crafted request, including a logged-in administrator.
Affected products
| Product | Affected versions |
|---|---|
| Five Star Restaurant Reviews WordPress Plugin | before 2.3.14 |
Versions were read from the advisory text. No structured product data has been published for this record yet.