WordPress security by component
Restaurant Menu by MotoPress
Plugin description
Restaurant Menu by MotoPress creates restaurant menus with categorized dishes, descriptions, prices, images, and display layouts.
Restaurant Menu by MotoPress (mp-restaurant-menu) is a WordPress plugin with 7 published CVE records in this archive. The latest tracked vulnerability was published Sep 25, 2026; the highest published CVSS base score is 8.8.
Plugin slug:
mp-restaurant-menuLatest vulnerability
CVE-2026-96568: Restaurant Menu and Food Ordering: Cross-site scripting
Restaurant Menu and Food Ordering (affected: <= 2.4.14). An unauthenticated attacker can supply script markup in phone_number. Insufficient validation and output escaping allow that value to persist and execute when the affected content is viewed. The submission endpoint and exact rendering function are unspecified.
| Safe version |
|
||
|---|---|---|---|
| Sep 25, 2026 |
CVE-2026-96568
Restaurant Menu and Food Ordering: Cross-site scripting
Restaurant Menu and Food Ordering (affected: <= 2.4.14). An unauthenticated attacker can supply script markup in phone_number. Insufficient validation and output escaping allow that value to persist and execute when the affected content is viewed. The submission endpoint and exact rendering function are unspecified.
|
2.4.15 |
CVE7.2
|
| Aug 18, 2026 |
CVE-2026-73400
Restaurant Menu by MotoPress: Filesystem traversal
Restaurant Menu by MotoPress is affected by filesystem traversal. The vulnerable path is reachable without authentication. A crafted path can escape the intended directory and reach files or directories elsewhere on the server. The published affected range is n/a through 2.4.11.
|
See mitigation notes |
CVE8.1
|
| Jun 26, 2026 |
CVE-2026-57644
Restaurant Menu by MotoPress: SQL injection
Restaurant Menu by MotoPress is affected by SQL injection. Exploitation requires an authenticated contributor account. A successful request can alter database queries and expose or modify WordPress data. The published affected range is n/a through 2.4.10.
|
2.4.11 |
CVE8.5
|
| Jun 26, 2026 |
CVE-2025-63078
Restaurant Menu by MotoPress: Broken access control
Restaurant Menu by MotoPress is affected by broken access control. Exploitation requires an authenticated subscriber account. A successful request can reach data or an operation that should be restricted to another user or a more privileged role. The published affected range is n/a through 2.4.11.
|
See mitigation notes |
CVE4.3
|
| Dec 18, 2025 |
CVE-2025-49914
Restaurant Menu by MotoPress: A security weakness
Restaurant Menu by MotoPress is affected by a security weakness. Exposure depends on how the affected operation is made reachable by the site. The resulting impact depends on how the affected component exposes the vulnerable operation.
|
See mitigation notes |
CVE6.5
|
| Jul 16, 2025 |
CVE-2025-54038
Restaurant Menu by MotoPress: Cross-site request forgery
Restaurant Menu by MotoPress is affected by cross-site request forgery. Exposure depends on how the affected operation is made reachable by the site. Exploitation relies on a signed-in privileged user submitting an attacker-controlled request.
|
See mitigation notes |
CVE5.4
|
| Mar 27, 2025 |
CVE-2025-30846
Restaurant Menu by MotoPress: Filesystem traversal
Restaurant Menu by MotoPress is affected by filesystem traversal. Exposure depends on how the affected operation is made reachable by the site. A crafted path can escape the intended directory and reach files or directories elsewhere on the server.
|
See mitigation notes |
CVE8.8
|