CVEs we hold for Rustaurius
Records whose assigning authority named Rustaurius as the affected vendor. Newest identifiers first, capped at 200.
CVE-2026-6498Five Star Restaurant Reservations <= 2.7.16 - Unauthenticated Payment Bypass via PHP Type Juggling in 'payment_id'…rustaurius Five Star Restaurant Reservations – WordPress…
CVE-2026-54835WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerabilityRustaurius Five Star Restaurant Menu
CVE-2026-4336Ultimate FAQ Accordion Plugin <= 2.4.7 - Authenticated (Author+) Stored Cross-Site Scripting via FAQ Contentrustaurius Ultimate FAQ Accordion Plugin
CVE-2026-39602WordPress Order Tracking plugin <= 3.4.3 - Broken Access Control vulnerabilityRustaurius Order Tracking
CVE-2026-27436WordPress Five Star Business Profile and Schema plugin <= 2.3.19 - Arbitrary Code Execution vulnerabilityRustaurius Five Star Business Profile and Schema
CVE-2026-25327WordPress Five Star Restaurant Reservations plugin <= 2.7.9 - Broken Access Control vulnerabilityRustaurius Five Star Restaurant Reservations
CVE-2026-24634WordPress Ultimate Reviews plugin <= 3.2.16 - Insecure Direct Object References (IDOR) vulnerabilityRustaurius Ultimate Reviews
CVE-2025-6993Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via…rustaurius Ultimate WP Mail
CVE-2025-68601WordPress Five Star Restaurant Reservations plugin <= 2.7.8 - Cross Site Request Forgery (CSRF) vulnerabilityRustaurius Five Star Restaurant Reservations
CVE-2025-68044WordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerabilityRustaurius Five Star Restaurant Reservations
CVE-2025-67590WordPress Ultimate FAQ plugin <= 2.4.3 - Cross Site Request Forgery (CSRF) vulnerabilityRustaurius Ultimate FAQ
CVE-2025-62072WordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerabilityRustaurius Front End Users
CVE-2025-58235WordPress Front End Users plugin <= 3.2.35 - Cross Site Scripting (XSS) vulnerabilityRustaurius Front End Users
CVE-2025-53454WordPress Ultimate WP Mail Plugin <= 1.3.8 - Cross Site Scripting (XSS) VulnerabilityRustaurius Ultimate WP Mail
CVE-2025-49288WordPress Ultimate WP Mail plugin <= 1.3.5 - Account Takeover via Email Log Leak VulnerabilityRustaurius Ultimate WP Mail
CVE-2025-49266WordPress Ultimate Reviews plugin <= 3.2.14 - Reflected Cross Site Scripting (XSS) vulnerabilityRustaurius Ultimate Reviews
CVE-2025-47580WordPress Front End Users plugin <= 3.2.35 - Broken Access Control vulnerabilityRustaurius Front End Users
CVE-2025-47490WordPress Ultimate WP Mail plugin <= 1.3.4 - SQL Injection VulnerabilityRustaurius Ultimate WP Mail
CVE-2025-47466WordPress Ultimate WP Mail plugin <= 1.3.4 - Cross Site Request Forgery (CSRF) VulnerabilityRustaurius Ultimate WP Mail
CVE-2025-32694WordPress Ultimate WP Mail plugin <= 1.3.10 - Open Redirection vulnerabilityRustaurius Ultimate WP Mail
CVE-2025-30861WordPress Five Star Restaurant Reservations plugin <= 2.6.29 - Broken Access Control vulnerabilityRustaurius Five Star Restaurant Reservations
CVE-2025-26877WordPress Front End Users Plugin <= 3.2.30 - Cross Site Scripting (XSS) vulnerabilityRustaurius Front End Users
CVE-2025-2005Front-End-Only-Users <= 3.2.32 - Unauthenticated Arbitrary File Uploadrustaurius Front End Users
CVE-2025-11799Affiliate AI Lite <= 1.0.1 - Authenticated (Contributor+) Stored Cross-Site Scriptingrustaurius Affiliate AI Lite
CVE-2025-11496Five Star Restaurant Reservations – WordPress Booking Plugin <= 2.7.5 - Unauthenticated Stored Cross-Site Scriptingrustaurius Five Star Restaurant Reservations – WordPress…
CVE-2024-7607Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injectionrustaurius Front End Users
CVE-2024-7606Front End Users <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcoderustaurius Front End Users
CVE-2024-5459Restaurant Menu and Food Ordering <= 2.4.16 - Missing Authorization to Menu Creationrustaurius Five Star Restaurant Menu and Food Ordering
CVE-2024-13563Front End Users <= 3.2.30 - Authenticated (Contributor+) Stored Cross-Site Scripting via forgot-password Shortcoderustaurius Front End Users
CVE-2024-12410Front End Users <= 3.2.32 - Authenticated (Admin+) SQL injectionrustaurius Front End Users
CVE-2023-4500Order Tracking Pro <= 3.3.6 - Authenticated (Administrator+) Stored Cross-Site Scriptingrustaurius Order Tracking – WordPress Status Tracking Plugin
CVE-2023-4471Order Tracking Pro <= 3.3.6 - Reflected Cross-Site Scriptingrustaurius Order Tracking – WordPress Status Tracking Plugin
33 records, read from the index as it stood on 20 Sep 2026. Every row opens the record it names, and every value on that record opens its own receipt.
Everything on this page is free. Public data. Withholding it protects nothing.