Vulnerabilities and security researches formp-restaurant-menu mp-restaurant-menu

Jun 06, 2024

CVE, Research URL: CVE-2021-24722
Home page URL: Security reports for Restaurant Menu and Food Ordering
Application: Restaurant Menu and Food Ordering
Date: Nov 01, 2021
Research Description: The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Affected versions: max 2.4.2.
Status: vulnerable

Apr 02, 2025

CVE, Research URL: CVE-2025-30846
Home page URL: Security reports for Restaurant Menu and Food Ordering
Application: Restaurant Menu and Food Ordering
Date: Mar 27, 2025
Research Description: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows PHP Local File Inclusion.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.4.
Affected versions: max 2.4.5.
Status: vulnerable

Jul 18, 2025

CVE, Research URL: CVE-2025-54038
Home page URL: Security reports for Restaurant Menu and Food Ordering
Application: Restaurant Menu and Food Ordering
Date: Jul 16, 2025
Research Description: Cross-Site Request Forgery (CSRF) vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Cross Site Request Forgery.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.6.
Affected versions: max 2.4.7.
Status: vulnerable

Jan 10, 2026

CVE, Research URL: CVE-2025-49914
Home page URL: Security reports for Restaurant Menu and Food Ordering
Application: Restaurant Menu and Food Ordering
Date: Dec 18, 2025
Research Description: Exposure of Sensitive System Information to an Unauthorized Control Sphere vulnerability in jetmonsters Restaurant Menu by MotoPress mp-restaurant-menu allows Retrieve Embedded Sensitive Data.This issue affects Restaurant Menu by MotoPress: from n/a through <= 2.4.7.
Affected versions: max 2.4.8.
Status: vulnerable

Jun 30, 2026

CVE, Research URL: CVE-2026-57644
Home page URL: Security reports for Restaurant Menu and Food Ordering
Application: Restaurant Menu and Food Ordering
Date: Jun 26, 2026
Research Description: Contributor SQL Injection in Restaurant Menu by MotoPress <= 2.4.10 versions.
Affected versions: max 2.4.11.
Status: vulnerable

CVE, Research URL: CVE-2025-63078
Home page URL: Security reports for Restaurant Menu and Food Ordering
Application: Restaurant Menu and Food Ordering
Date: Jun 26, 2026
Research Description: Subscriber Broken Access Control in Restaurant Menu by MotoPress <= 2.4.11 versions.
Affected versions: max 2.4.11.
Status: vulnerable

Aug 21, 2026

CVE, Research URL: CVE-2026-73400
Home page URL: Security reports for Restaurant Menu and Food Ordering
Application: Restaurant Menu and Food Ordering
Date: Aug 18, 2026
Research Description: Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.
Affected versions: max 2.4.11.
Status: vulnerable

Sep 06, 2026

CVE, Research URL: CVE-2026-84044
Home page URL: Security reports for Restaurant Menu and Food Ordering
Application: Restaurant Menu and Food Ordering
Date: Sep 04, 2026
Research Description: The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.
Affected versions: max 2.4.12.
Status: vulnerable