The ReDi Restaurant Reservation plugin for WordPress contains an improper neutralization of input flaw that allows an attacker to inject arbitrary script into a rendered page. This reflected XSS can execute in the victim’s browser, potentially stealing session cookies, defacing content, or redirecting users to malicious sites. The vulnerability is a classic example of CWE-79, where user-controlled data is reflected without adequate sanitization.

WordPress sites running the ReDi Restaurant Reservation plugin, version 24.1209 or earlier. The plugin is distributed by catkin and is commonly used for restaurant booking and reservation functionalities.

With a CVSS score of 7.1 the severity is considered moderate to high. The EPSS score of less than 1% indicates a very low probability of attack at this time, and the issue is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply crafted input in a form field or URL parameter that the plugin echoes back into a page, which is likely to be provided through the public booking interface. The impact is confined to client-side execution, but serious if the victim is an administrator or a customer with sensitive data.