Skip to content
Fencer Vulns
medium 6.1

CVE-2021-24299 json

ReDi Restaurant Reservations < 21.0426 - Unauthenticated Stored Cross-Site Scripting (XSS)

published 2021-05-17 5 y ago modified 2026-06-17 4 mo ago also EUVD-2021-11213

cvss
6.1
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
5.5%
EPSS 5.5% chance of exploitation in 30 days, percentile 92%
public exploits
1
Exploit-DB

Summary

The ReDi Restaurant Reservation WordPress plugin before 21.0426 provides the functionality to let users make restaurant reservations. These reservations are stored and can be listed on an 'Upcoming' page provided by the plugin. An unauthenticated user can fill in the form to make a restaurant reservation. The form to make a restaurant reservation field called 'Comment' does not use proper input validation and can be used to store XSS payloads. The XSS payloads will be executed when the plugin user goes to the 'Upcoming' page, which is an external website https://upcoming.reservationdiary.eu/ loaded in an iframe, and the stored reservation with XSS payload is loaded.

Patch / fix

  • catzsoft redi_restaurant_reservation 21.0426

Timeline

  1. Published
  2. First public exploit (EDB-49903)

Exploit prediction

5.50% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-49903 WordPress Plugin ReDi Restaurant Reservation 21.0307 - 'Comment' Stored Cross-Site Scripting (XSS) webapps, 2021-05-24
  • wpscan.com https://wpscan.com/vulnerability/fd6ce00b-8c5f-4180-b648-f47b37303670 referenced PoC, tagged "exploit" by a source, unverified
  • packetstormsecurity.com http://packetstormsecurity.com/files/162756/WordPress-ReDi-Restaurant-Reservation-21.0307-Cross-Site-Scripting.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Affected products

  • Reservation Diary ReDi Restaurant Reservation

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.