Skip to content
OpenAdvisories

Vendor

Rustaurius

34 known vulnerabilities.

Products

Front End Users 9 Ultimate WP Mail 6 Five Star Restaurant Reservations 4 Ultimate Reviews 3 Five Star Restaurant Reservations – WordPress Booking Plugin 2 Ultimate FAQ 2 Order Tracking – WordPress Status Tracking Plugin 2 Five Star Restaurant Menu 1 Five Star Restaurant Menu and Food Ordering 1 Ultimate FAQ Accordion Plugin 1 Affiliate AI Lite 1 Five Star Business Profile and Schema 1 Order Tracking 1
All Critical High Medium Low Exploited only Public exploit

7 results · Clear filters · Feed

  • High 7.5
    CVE-2026-54835

    WordPress Five Star Restaurant Menu plugin <= 2.5.2 - Broken Access Control vulnerability

    Unauthenticated Broken Access Control in Five Star Restaurant Menu <= 2.5.2 versions.

    Rustaurius Five Star Restaurant Menu
  • High 8.6
    CVE-2025-68044

    WordPress Five Star Restaurant Reservations plugin <= 2.7.4 - Insecure Direct Object References (IDOR) vulnerability

    Authorization Bypass Through User-Controlled Key vulnerability in Rustaurius Five Star Restaurant Reservations restaurant-reservations allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Five Star Restaurant Reservations…

    Rustaurius Five Star Restaurant Reservations
  • High 7.5
    CVE-2025-6993

    Ultimate WP Mail 1.0.17 - 1.3.6 - Missing Authorization to Authenticated (Contributor+) Privilege Escalation via get_email_log_details Function

    The Ultimate WP Mail plugin for WordPress is vulnerable to Privilege Escalation due to improper authorization within the get_email_log_details() AJAX handler in versions 1.0.17 to 1.3.6. The handler reads the client-supplied post_id and retrieves the correspo…

    Rustaurius Ultimate WP Mail Web / CMS
  • High 7.1
    CVE-2025-49266

    WordPress Ultimate Reviews plugin <= 3.2.14 - Reflected Cross Site Scripting (XSS) vulnerability

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Rustaurius Ultimate Reviews ultimate-reviews allows Reflected XSS.This issue affects Ultimate Reviews: from n/a through <= 3.2.14.

    Rustaurius Ultimate Reviews
  • High 8.8
    CVE-2025-49288

    WordPress Ultimate WP Mail plugin <= 1.3.5 - Account Takeover via Email Log Leak Vulnerability

    Missing Authorization vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows Authentication Bypass.This issue affects Ultimate WP Mail: from n/a through <= 1.3.5.

    Rustaurius Ultimate WP Mail
  • High 8.5
    CVE-2025-47490

    WordPress Ultimate WP Mail plugin <= 1.3.4 - SQL Injection Vulnerability

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Rustaurius Ultimate WP Mail ultimate-wp-mail allows SQL Injection.This issue affects Ultimate WP Mail: from n/a through <= 1.3.4.

    Rustaurius Ultimate WP Mail
  • High 8.8
    CVE-2024-7607

    Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection

    The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the exi…

    Rustaurius Front End Users Web / CMS