Quick Restaurant Menu
Approved changes feed: RSS · Atom
cpe:2.3:a:thingsforrestaurants:quick_restaurant_menu:*:*:*:*:*:wordpress:*:*
part: a version: * update: *
| Vendor | Thingsforrestaurants (042cecb7-80fb-5b2d-b72f-729b3ee8021e) |
|---|---|
| Product | Quick Restaurant Menu (c6d6fba3-db92-569c-867c-ccc8bb8848fe) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
| Notes | Imported from purl2cpe mapping |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/alejandropascual/quick-restaurant-menu |
purl2cpe | 2026-06-01 10:14:36.334601 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2023-0555 |
vulnerable | 2026-06-08 05:52:31.917158 |
Quick Restaurant Menu <= 2.0.2 - Missing Authorization
HIGH (8.1)
The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those actions intended for administrator use. Actions include menu item creation, update and deletion and other menu management functions. Since the plugin does not verify that a post ID passed to one of its AJAX actions belongs to a menu item, this can lead to arbitrary post deletion/alteration.
Published: 2023-01-27T20:31:13.539Z
Updated: 2026-04-08T17:10:28.703Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0554 |
vulnerable | 2026-06-08 05:52:31.916734 |
Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgery
HIGH (8.1)
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
Published: 2023-01-27T20:28:40.673Z
Updated: 2026-04-08T17:19:30.170Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0553 |
vulnerable | 2026-06-08 05:52:31.916121 |
Quick Restaurant Menu <= 2.0.2 - Authenticated (Administrator+) Cross-Site Scripting
MEDIUM (4.4)
The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
Published: 2023-01-27T20:27:30.817Z
Updated: 2026-04-08T17:24:44.163Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2023-0550 |
vulnerable | 2026-06-08 05:52:31.910941 |
Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference
HIGH (8.1)
The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided to the AJAX action is indeed a menu item. This makes it possible for authenticated attackers, with subscriber-level access or higher, to modify or delete arbitrary posts.
Published: 2023-01-27T20:17:19.283Z
Updated: 2026-04-08T17:34:24.761Z Reference links
|
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.