CVE-2022-2753: Ketchup Restaurant Reservations plugin unauthenticated stored XSS

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: medium.

high priorityUnauthenticated stored XSS with public exploit code and very high EPSS, but impact is limited to admin-triggered execution and no KEV or ransomware evidence.

What it is

The Ketchup Restaurant Reservations WordPress plugin through 1.0.0 does not sanitise or escape some reservation user inputs. Unauthenticated attackers can submit a malicious reservation that executes script when a logged-in admin views it. This is a stored cross-site scripting flaw in a plugin that is no longer maintained at the affected version.

Impact

An attacker can run arbitrary script in the context of an authenticated administrator's session, enabling session theft, admin account takeover, or injection of further malicious content into the site.

Attack surface

Reachable over the network through the plugin's public reservation form, which requires no authentication; exploitation requires the victim admin to view the malicious reservation, so user interaction on the admin side is needed.

Exploitation

No CISA KEV listing and no ransomware association; EPSS is very high (0.83373, 99.7th percentile) and both references are tagged Exploit, indicating public exploit code exists.

What to do

• Update or remove the Ketchup Restaurant Reservations plugin; version 1.0.0 is the last known release and no fixed version is documented, so decommissioning the plugin is the safest path.
• If the plugin must stay, apply input sanitisation and output escaping to all reservation fields and restrict admin review of reservations to trusted users.
• Deploy a web application firewall rule to block script payloads in reservation form submissions.
• Audit administrator accounts and rotate credentials and salts if a malicious reservation may have been viewed.
• Monitor plugin vendor channels for a patched release and apply it as soon as available.

Detection

• Search reservation records and database tables for script tags, event handlers, or encoded JavaScript in user-supplied fields.
• Review web server and plugin logs for reservation POST requests containing suspicious payloads from unauthenticated clients.
• Monitor for unexpected admin session activity, new admin users, or content changes following reservation reviews.
• Alert on WAF or application logs matching known XSS patterns in reservation submissions.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.