WordPress Quick Restaurant 2.0.2 XSS / CSRF / IDOR / Missing Authorization

On January 16, 2023, the Wordfence Threat Intelligence team responsibly disclosed several vulnerabilities in Quick Restaurant Menu, a WordPress plugin that allows users to set up restaurant menus on their sites. This plugin is vulnerable to missing authorization, insecure direct object reference, cross site request forgery as well as cross site scripting in versions up to, and including, 2.0.2.

authorization cross site scripting csrf forgery idor insecure intelligence january missing object plugin reference request restaurant scripting team threat threat intelligence vulnerabilities vulnerable wordfence wordpress wordpress plugin xss