CVE-2026-25025: Reflected XSS in VikRestaurants WordPress Plugin

An attacker exploiting this XSS vulnerability can inject arbitrary JavaScript code into the VikRestaurants plugin's output. This code can then be executed in the context of a victim's browser when they visit a specially crafted URL. The impact ranges from simple annoyance (displaying misleading content) to severe consequences like session hijacking, credential theft, and redirection to malicious websites. Successful exploitation could allow an attacker to impersonate legitimate users, gain access to sensitive data stored within the WordPress site, or even deface the website. The scope of the attack is limited to users who interact with the vulnerable VikRestaurants plugin, but a popular plugin increases the potential attack surface.

1. Reserved2026-01-28
2. Published2026-03-25
3. Modified2026-04-28
4. EPSS updated2026-04-02

The primary mitigation for CVE-2026-25025 is to immediately upgrade the VikRestaurants plugin to version 1.5.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include input validation and output encoding on user-supplied data within the plugin's templates. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of defense. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) through a vulnerable parameter and confirming that the script is not executed.

Active installs

600

Plugin rating