The Five Star Restaurant Reservations – WordPress Booking Plugin is vulnerable to a stored cross‑site scripting (XSS) flaw that originates from the rtb‑name parameter. The plugin fails to properly sanitize or escape the content before storing it, so an unauthenticated attacker can embed arbitrary JavaScript. When an affected page is later viewed, the embedded script runs in the victim’s browser, potentially allowing session hijacking, defacement, or malware delivery. This weakness is classified as CWE‑79.

The vulnerability is present in all releases of the plugin up to and including version 2.7.5 supplied by rustaurius. The affected system is any WordPress site that has the Five Star Restaurant Reservations – WordPress Booking Plugin installed without updating past the specified version. No other versions or components are listed as affected.

The CVSS score is 6.1, indicating moderate severity. The EPSS score is less than 1 %, meaning exploit attempts are currently rare, and the flaw is not listed in the CISA KEV catalogue. Nevertheless, because the attack vector requires only an unauthenticated HTTP request and the injected payload executes automatically for any visitor of the affected page, the risk to sites that allow public access can be high. The flaw can be exploited with minimal prerequisites and does not require privileged credentials.