WordPress VikRestaurants plugin <= 1.5.2 - Reflected Cross Site Scripting (XSS) vulnerability

An attacker exploiting this XSS vulnerability can inject arbitrary JavaScript code into the VikRestaurants plugin's output. This code can then be executed in the context of a victim's browser when they visit a specially crafted URL. The impact ranges from simple annoyance (displaying misleading content) to severe consequences like session hijacking, credential theft, and redirection to malicious websites. Successful exploitation could allow an attacker to impersonate legitimate users, gain access to sensitive data stored within the WordPress site, or even deface the website. The scope of the attack is limited to users who interact with the vulnerable VikRestaurants plugin, but a popular plugin increases the potential attack surface.

Websites utilizing the VikRestaurants WordPress plugin, particularly those with user input fields that are not properly sanitized, are at risk. Shared hosting environments where multiple websites share the same server resources are also at increased risk, as a successful exploit on one site could potentially impact others.

• wordpress / composer / npm:

grep -r '<script>' /var/www/html/wp-content/plugins/vikrestaurants/*

• wordpress / composer / npm:

wp plugin list --status=all | grep vikrestaurants

• wordpress / composer / npm:

wp plugin update vikrestaurants

• generic web: Inspect URL parameters for suspicious characters or script tags when accessing VikRestaurants plugin features. • generic web: Review WordPress error logs for any JavaScript errors related to VikRestaurants.

1. 2026-03-25Disclosure

   disclosure

活跃安装数

600

插件评分

4.8

需要WordPress版本

4.7+

兼容至

7.0

需要PHP版本

7.4.0+

1. 已保留2026-01-28
2. 发布日期2026-03-25
3. 修改日期2026-04-28
4. EPSS 更新日期2026-04-02

The primary mitigation for CVE-2026-25025 is to immediately upgrade the VikRestaurants plugin to version 1.5.3 or later. If upgrading is not immediately feasible due to compatibility issues or testing requirements, consider implementing temporary workarounds. These may include input validation and output encoding on user-supplied data within the plugin's templates. Web Application Firewalls (WAFs) configured to detect and block XSS payloads can also provide a layer of defense. After upgrading, verify the fix by attempting to inject a simple XSS payload (e.g., <script>alert(1)</script>) through a vulnerable parameter and confirming that the script is not executed.