Authenticated (custom plugin role) Arbitrary File Read via Export function vulnerability in GiveWP's GiveWP plugin <= 2.20.2 at WordPress.

CVE-2022-31475: GiveWP – Donation Plugin and Fundraising Platform

Authenticated Stored Cross-Site Scripting (XSS) vulnerability in Florent Maillefaud's WP Maintenance plugin <= 6.0.7 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

The WP Maintenance plugin allows you to put your website on the waiting time for you to do maintenance or launch your website. Personalize this page, pictures and countdown with:

**Features**

*   Choice texts colors and fonts
*   Upload logo picture
*   Upload background picture or pattern
*   Countdown
*   Custom Code Header for Analytics ready
*   Social Networks ready
*   Customize CSS
*   Insert for shorcode (Newletter or Contact form)
*   Enable “503 Service temporarily unavailable”
*   Choose access by Roles and Capabilities
*   Choose access by IP address
*   Choose access by ID Pages

wp-maintenance.pot file available

1.  Upload the full directory into your ‘/wp-content/plugins’ directory
2.  Activate the plugin at the plugin administration page

You will find ‘WP Maintenance’ menu in your WordPress admin panel

**WP Maintenance Needs Your Support**

It is hard to continue development and support for this free plugin without contributions from users like you. If you enjoy using WP Maintenance and find it useful, please consider making a donation. Your donation will help encourage and support the plugin’s continued development and better user support.

**I have activated plugin and don’t see any changes, looks like plugin is not working.**

This is normal because you are logged in as an administrator. Try a different browser or use the preview link. If you have registered as a wordpress user, you see the site in normal mode.

**I have disabled plugin but I don’t see any changes, I have always the maintenance page, looks like plugin is not working.**

You have a cache plugin ? Try to purge it and try again.

**Where can I find out the login page to get to the site?**

You can use your administrator access or create new user in wordpress dashboard  
https://yousite.com/wp-admin/

**Can I change the plugin code?**

Yes. Thank you for submitting your changes to update the plugin.

**Translations**

You can translate WP Maintenance on **translate.wordpress.org**.

très bon plugin, seul bémol il ne fonctionne pas sur les mobiles, impossible de l'activer sur les mobiles

Propre, efficace, maintenue, gratuite, que demander de + ? Merci au dev !

Efficace et pratique. Merci à l'Auteur

Je pensais avoir trouvé un super widget avec celle-ci, mais elle réagit vraiment bizarrement au point ou parfois on perd du temps pour savoir si des choses marchent. La page rs notamment. On dit que l'on peut mettre ses propres images rs. Cela ne marche pas... et je ne sais pas pourquoi... d'autant que l'appli semble vous aider en ajoutant l'url du dossier de destination. Mais quand vous complétez le chemin et enregistrez... ben il commence forcement l'enregistrement par https... parmi les icônes proposées une série fonctionne pas... tout ça est bien dommage. Enfin si l'auteur peut déjà "clarifier" et comment on met ses propres icones ce serait cool.

Отличный дизайн плагина и полный перевод на русский язык. Спасибо!

3 mn chrono pour ma page ! Bravo.

Read all 71 reviews

“WP Maintenance” is open source software. The following people have contributed to this plugin.

Contributors

*    Florent Maillefaud

CVE-2022-30536: WP Maintenance

Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option update.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

This plugin extends WooCommerce to allow shop owners to add custom tabs to products. The tabs are displayed on the individual product pages to the right of the default “Description” tab.

Individual product tabs are managed on the WooCommerce Edit Product screen and can be added on a per product basis. You can also create saved tabs and add them to multiple products as needed. Tabs can be easily added, deleted and rearranged.

Tab content areas use the standard WordPress text editor and may contain text, images, HTML or shortcodes.

If you experience any problems, please submit a ticket on our Free WordPress Support Forums and we’ll look in to it as soon as possible.

This plugin is compatible with WPML.

Upgrade to Custom Product Tabs Pro for great enhanced features!

1.  Download the plugin .zip file and make note of where on your computer you downloaded it to.
2.  In the WordPress admin (yourdomain.com/wp-admin) go to Plugins > Add New or click the “Add New” button on the main plugins screen.
3.  On the following screen, click the “Upload Plugin” button.
4.  Browse your computer to where you downloaded the plugin .zip file, select it and click the “Install Now” button.
5.  After the plugin has successfully installed, click “Activate Plugin” and enjoy!
6.  Edit a product, then click on ‘Custom Tab’ within the ‘Product Data’ panel
7.  Create saved, reusable tabs under Settings > Custom Product Tabs for WooCommerce

**All documentation can be found in our Knowledge Base.**

**Where do I go to add tabs to a product?**

When editing a product in WooCommerce, you will find “Custom Tabs” in the bottom left corner of the Product Data box. Click on “Custom Tabs” to reveal the custom tab manager.

**Where will these tabs appear?**

When the product is viewed on your website you will see the tabs you created to the right of the default “Description” tab.

**How do I change the order of the tabs?**

To change the order of custom tabs use the up and down “Move tab order” arrows.

**How do saved tabs work?**

Saved tabs are tabs you can create and then add to as many products you would like. If you update a saved tab, the changes will be updated for all products using that tab.

**How do I create saved tabs?**

To create a saved tab, click on the ‘Custom Product Tabs’ item on the WordPress dashboard menu and click the “Add Tab” button.

**How do I add a saved tab to a product?**

To add a saved tab to a product, go to the custom tabs section on the edit product screen, click the ‘Add a Saved Tab’ button above the tab, and choose which tab you would like to add.

**What does overriding a saved tab do?**

When using a saved tab on a product, a checkbox appears with the message ‘Override Saved Tab’ If you click that checkbox, edit the tab and save, the tab will be changed for that product only. Any edits to that saved tab under ‘Custom Product Tabs’ will not be applied to that product.

**Why does the WYSIWYG editor default to the ‘Visual’ tab?**

This was added in version 1.5 to support the dynamic adding and removing of the wp\_editor/WYSIWYG editor. Without this setting, the WYSIWYG editor does not load the correct toolbar and the editor can potentially break.

**Does custom tab data get exported with standard WooCommerce product data?**

Yes! Since v1.4 we’ve added the necessary code to ensure the custom tab data is exported with all of the other standard WooCommerce data. This ensures a smooth transition of products between sites.

Thank you for creating this useful plugin.

Hey Guys, I really respect that you think about the others. <3 <3 <3

Doesn't display new tabs, even with the apply\_filters checked. Useless for me.

I just added this plugin to a site and so far it works great. Thanks to the author!

Thank you very much for such helpful and very simple tabs for the woocommerce.

Every time there is an update something stops working.

Read all 145 reviews

“Custom Product Tabs for WooCommerce” is open source software. The following people have contributed to this plugin.

Contributors

**1.7.9 – June 21st, 2022**

*   Address minor vulnerability
*   Fix issue related to Divi Builder

**1.7.7 – March 8th, 2021**

*   Housekeeping

**1.7.6 – October 19th, 2020**

*   WooCommerce 4.6 tested.

**1.7.5 – September 18th, 2020**

*   Swapping (deprecated) wp\_make\_content\_images\_responsive for wp\_filter\_content\_tags in our content filter. Thanks @stephencd!

**1.7.4 – September 12th, 2020**

*   WooCommerce 4.5.

**1.7.3 – August 19th, 2020**

*   WooCommerce 4.4.
*   Fixes issues related to WordPress 5.5.

**1.7.1 – March 13th, 2020**

*   Fixes a bug with product display in certain conditions.

**1.7.0 – March 10th, 2020**

*   Toggle the content filter on or off setting added. Use this to help with compatibility.
*   Support WooCommerce 4.0.
*   Support WordPress 5.4.

**1.6.13 – January 22nd, 2020**

*   Support WooCommerce 3.9.

**1.6.12 – November 20th, 2019**

*   Support WooCommerce 3.8.

**1.6.11 – September 25th, 2019**

*   Adding additional checks to post global before enqueueing assets.

**1.6.10 – April 19th, 2019**

*   Updating WC compatibility.
*   Fixing JS issue with WP backwards compatibility for versions < 4.7.

**1.6.9 – January 18th, 2019**

*   Fixing an issue where the visual editor shows a small portion of the content on product edit pages.

**1.6.8 – January 2nd, 2019**

*   Fixing some HTML markup.
*   Applying PHPCS fixes.

**1.6.7 – December 18th, 2018**

*   Adding filter to help allow importing of custom tabs.
*   Changing our export filters so custom tabs work with WooCommerce’s native meta export/import features.
*   The default capability for all admin pages is now publish_products.

**1.6.6 – October 26th, 2018**

*   Bumping WooCo Compatibility.
*   Changed wp_send_json_failure() to wp_send_json_error().

**1.6.5 – October 3rd, 2018**

*   Bumping WooCo Compatibility.

**1.6.4 – January 9th, 2018**

*   Happy new year!
*   The editor is now vertically resizeable.
*   The default capability for interacting with saved tabs is now Publish Products (publish\_products)

**1.6.3 – November 1st, 2017**

*   Declaring compatibility with WooCommerce and WordPress

**1.6.2 – October 13th, 2017**

*   Fixed a PHP Fatal Error that was occurring for users with PHP versions < 5.5.
*   Updated some of our documentation and language

**1.6.1 – October 12th, 2017**

*   Fixed an issue with handling foreign characters. Foreign character tab titles should be working properly now. Sorry about that everyone!
*   Added support for native WooCommerce exporting. You can now export and import your tabs with just WooCommerce!
*   Fixed some styling issues
*   Added a new “Support” page
*   Added a new “Go Pro” page – check out Custom Product Tabs Pro

**1.6.0 – October 9th, 2017**

*   Complete re-organization of all plugin files and removal of legacy code
*   Added a “name” field for saved tabs. This field is used only on the admin as a way of identifying tabs.
*   Tab “slugs” are now created via the WP Core sanitize_title() function. This should allow meaningful tab slugs when foreign characters are used in a title.
*   Re-added the “Add Media” button to the editor when it’s first initialized. This had disappeared when WP4.8 was released.
*   Fixed some issues with loading saved tab content into the editor. This should fix the issue that some users were experiencing where adding a saved tab would only work the second time.
*   Setting the width of the editor to 100%.
*   Custom Product Tabs is now a top-level menu item instead of a sub-menu item.
*   Cleaning up the saved tab’s array so we don’t leave orphaned data (e.g. added a hook so we delete a product’s tabs when the product is deleted)
*   Added a data update script to update all existing tab slugs to use sanitize_title() function.
*   Generated new POT file.
*   Added support and hooks for our new Custom Product Tabs Pro plugin!

**1.5.17 – August 23rd, 2017**

*   Cleaning up some PHP Notices being thrown – thanks to @ZombiEquinox on GitHub for reporting this
*   Updating readme compatibility values

**1.5.16 – August 1st, 2017**

*   Adding a proper deactivation hook. The plugin will leave no trace.

**1.5.15 – June 8th, 2017**

*   WordPress 4.8 support – using the new JavaScript Editor API functions to instantiate the editor and removed requiring WordPress’ wpembed plugin

**1.5.14 – May 8th, 2017**

*   Updating some CSS for the admin tabs table – the table should now render correctly regardless of “Visual” or “Text” tab and the saved tabs list should include a scrollbar if necessary

**1.5.13 – April 17th, 2017**

*   Updating a WooCommerce action – now using the proper one instead of a deprecated one

**1.5.12 – April 10th, 2017**

*   Adding some CSS to allow the editor’s text mode to function properly

**1.5.11 – April 6th, 2017**

*   Checking for the existence of the get_id() method before using it.

**1.5.10 – April 5th, 2017**

*   Duplicating a product now duplicates custom product tabs and saved tabs correctly

**1.5.9 – April 4th, 2017**

*   Tested and updated the plugin for WooCommerce v3.0.0

**1.5.8 – March 17th, 2017**

*   Replaced the saved tab’s ID w/ an “Add New” button on the single saved tab page – it should be easier to add saved tabs in bulk now
*   Added a filter for all of the custom tab content – it should allow you to apply custom logic such as permissions in one central location
*   Changed the way saved tabs are applied on the edit product page – it should allow embed content (especially Google Maps Embed content) to function correctly in all instances.

**1.5.7 – February 27th, 2017**

*   Duplicating a product now duplicates the corresponding saved tabs correctly
*   Added two filters (yikes_woo_use_the_content_filter and yikes_woo_filter_main_tab_content) to help provide a work-around to using the standard the_content filter which has caused numerous issues due to plugin conflicts.

**1.5.6 – February 16th, 2017**

*   Fixed an issue where the “Add a Saved Tab” modal was displaying YouTube videos if a saved tab had a YouTube URL in its content

**1.5.5 – January 23rd, 2017**

*   Re-did 1.5.4 changes – checking for function existence before using it

**1.5.4 – January 23rd, 2017**

*   Re-did 1.5.3 changes – the_content filter is reapplied and the specific Site Builder plugin’s filters are

**1.5.3 – January 23rd, 2017**

*   Replaced the use of the_content filter with the filter’s associated functions (e.g. wptexturize, wpautop)

**1.5.2 – December 23rd, 2016**

*   The editor should only default to the ‘Visual’ tab for our Custom Product Tabs (no other editors)
*   Added all of the default WordPress settings to the editor

**1.5.1 – December 22nd, 2016**

*   Fixed bug that caused content to be copied incorrectly when moving tabs up / down
*   Only on the product page will the editor default to ‘Visual’ (instead of every page)

**1.5 – December 20th, 2016**

*   Version 1.5 includes a brand new feature – saved tabs – as well as a number of bug fixes, style tweaks, code clean-up, and comments
*   UI: Complete overhaul of the custom tab interface for an easier, responsive tab creating experience.
*   Saved Tabs: A new settings page has been added for users to create / update / delete saved tabs (see FAQ for more information)
*   Saved Tabs: On the product edit page, a new button (‘Add a Saved Tab’) has been added that allows you to choose one of your saved tabs and add it to the current product
*   Adding a new tab initializes a new wp\_editor (WYSIWYG) instead of a plain textarea
*   Added warning message when two tabs have the same title
*   Tabs with empty titles are no longer shown on the product page
*   Added ability to remove the first tab
*   Adding, moving, and removing tabs works as expected when the user’s ‘Visual Editor’ option is checked
*   On the product & settings pages, WYSIWYG editors will default to the visual tab (this helps prevent errors with dynamic wp\_editor generation)
*   Added a filter yikes_woocommerce_default_editor_mode that can change the default-to-visual-tab behavior (use at your own risk!)
*   Updated the ‘How To’ text, and slight modification to the style
*   Changed the JavaScript methods controlling how tabs were added, deleted, and moved up/down
*   Cleaned up and commented on all PHP and JavaScript files
*   Added proper i18n, with languages/ folder, .pot file, and load_plugin_textdomain hook
*   Incremented version #

**1.4.4 – March 1st, 2016**

*   Re-named the tab ID’s to support URL’s with query args (eg: http://www.example.com/shop#tab-reviews)

**1.4.3 – February 18th, 2016**

*   Wrapped missing ‘Custom Tab Title’ in localization/translation functions. (Plugin is now 100% translatable)
*   Removed i18n class files, and old .po/.mo files (less bloat)

**1.4.2 – February 17th, 2016**

*   Updated the internationalization strings ( yikes-inc-woocommerce-custom-product-tabs to yikes-inc-easy-custom-woocommerce-product-tabs )

**1.4.1 – August 20th, 2015**

*   Fixed conflict with other CSV export plugins for WooCommerce
*   Now custom product tab and row data/headers only get exported via ‘Tools > Export > Products’

**1.4 – July 29th, 2015**

*   Enhancement: Added the ‘Custom Product Tabs for WooCommerce ‘ data to the standard WooCommerce export file, so custom tab data can be transferred between sites smoothly.

**1.3 – July 21st, 2015**

*   Enhancement: Enabled WYSIWYG editor on tab content containers (enables shortcode and content to pass through the\_content() filter)
*   Updated repo screenshots and descriptions

**1.2 – March 18th, 2015**

*   Enhancement: Fixed issue where non utf8 characters in tab titles caused front end not to generate the tabs
*   Enhancement: When user doesn’t have WooCommerce installed, they are now redirected to the plugin install search page, with WooCommerce at the top.

**1.1**

*   Added class to the Woo tabs content title, for targeting via CSS ( .yikes-custom-woo-tab-title )

**1.0.0**

*   Initial Release

CVE-2022-28666: Custom Product Tabs for WooCommerce

Broken Access Control vulnerability in YIKES Inc. Custom Product Tabs for WooCommerce plugin <= 1.7.7 at WordPress leading to &yikes-the-content-toggle option update.



**Solution**

 Fixed

Update the WordPress Custom Product Tabs for WooCommerce plugin to the latest available version (at least 1.7.9).

Nguyen Anh Tien discovered and reported this Broken Authentication vulnerability in WordPress Custom Product Tabs for WooCommerce Plugin. This can be abused by a malicious actor to perform action which normally should only be able to be executed by higher privileged users. These actions might allow the malicious actor to gain admin access to the website. This vulnerability has been fixed in version 1.7.9.

**Other vulnerabilities in this plugin**

 0 present

 2 patched

View all

**WordPress plugin developer?**

Start a free security program for your WordPress plugins or request an audit.

Apply for MVDP

**Security researcher?**

Report to Patchstack Alliance bounty platform and earn monthly cash prizes.

Learn more

CVE-2022-28666: WordPress Custom Product Tabs for WooCommerce plugin <= 1.7.7 -  Broken Access Control vulnerability leading to &yikes-the-content-toggle option update - Patchstack

Cross-Site Request Forgery (CSRF) vulnerability in JoomUnited WP Meta SEO plugin <= 4.4.8 at WordPress allows an attacker to update the social settings.

CVE-2022-30337: WP Meta SEO

Cross-Site Request Forgery (CSRF) vulnerability in Sygnoos Popup Builder plugin <= 4.1.0 at WordPress leading to popup status change.

 Verified

 Fixed

**5.4**

CVSS 3.1 score Medium severity

Monitoring Coming soon

PSID 

de4f39bd2fdd

Classification 

Cross Site Request Forgery (CSRF)

OWASP Top 10 

A5: Broken Access Control

Publicly disclosed

2022-06-17

**Details**

Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change discovered by BEE-K (Patchstack) in WordPress Popup Builder plugin (versions <= 4.1.0).

**Solution**

Update the WordPress Popup Builder plugin to the latest available version (at least 4.1.1).

**References**

Changeset

CVE-2022-32289: WordPress Popup Builder plugin <= 4.1.0 - Cross-Site Request Forgery (CSRF) vulnerability leading to Popup Status Change - Patchstack

Unauthenticated SQL injection bugs put thousands of WordPress sites under threat

Unauthenticated SQL injection bugs put thousands of WordPress sites under threat

A researcher at security firm Cyllective has unearthed vulnerabilities in dozens of WordPress plugins, affecting tens of thousands of installations.

Dave Miller, who leads Cyllective’s penetration testing team, says they started out testing randomly selected plugins, quickly finding an unauthenticated SQL injection vulnerability.

They also found a series of local file inclusion and remote code execution (RCE) vulnerabilities. However, as these issues were found in severely outdated plugins, the team decided to concentrate its efforts on those that have received updates in the last two years – around 5,000 plugins in total.

**Exposed endpoints**

Looking particularly for unauthenticated SQL injection vulnerabilities, the researcher used a system of tags to identify plugins showing interaction with the WordPress database; string interpolation in SQL-like strings; security measures relating to sanitization attempts; and exposure of unauthenticated endpoints.

And after three months’ research, says Miller, the result was a total of 35 vulnerabilities, all of which could have been exploited by unauthenticated attackers, affecting around 60,500 instances running the affected WordPress plugins.

**RELATED** Unpatched plugins threaten millions of WordPress websites

“Although the vast majority of the vulnerabilities I reported were unauthenticated SQL injection vulnerabilities, which would have enabled an attacker to dump the entire WordPress database contents, these were not the most devastating ones,” Miller tells _The Daily Swig_.

“The sitemap-by-click5 plugin suffered from an unauthenticated arbitrary options update flaw, which would have allowed an attacker to maliciously enable the registration functionality and set the default user role to that of an administrator.”

This, he says, would essentially allow an unauthenticated attacker to create a new administrator account and take over the WordPress instance. And, from there, the attacker would be able to upload malicious PHP files, which would grant the attacker remote code execution capabilities on the underlying server as a low-privileged user.

**Looking for patterns**

With a bit more engineering, says Miller, the team's tag strategy could be used to fine flaws other than SQL injection vulnerabilities.

“New patterns would need to be developed which capture the specifics of the vulnerability class to be able to detect them,” he says. “Some vulnerability classes are, however, hard or even impossible to detect with this approach.”

Read more of the latest WordPress security news

Miller says that, despite the large number of vulnerabilities discovered, the disclosure process went smoothly, with the team reporting each vulnerability as it was discovered – on occasion, as many as four or five per day.

“WPScan \[a WordPress security vendor\] coordinated the process of communication between all the parties involved - researcher, plugin author and the WordPress plugin team – in a timely manner,” he says.

And, he adds, the team is still working through more plugins, with more vulnerabilities being discovered and responsibly disclosed.

“Security is ultimately the responsibility of the plugin developer, and the Plugin team encourages this to the best of its ability,” a WordPress spokesperson tells _The Daily Swi_g.

“To this end, guidelines exist for plugin authors to consult before submitting plugins to the directory. All developers are expected to abide by these guidelines. In addition, they have at their disposal a Plugin Handbook that covers security best practices.”

**DON’T MISS** W3C launches Decentralized Identifiers as a web standard

WordPress plugin security audit unearths dozens of vulnerabilities impacting 60,000 websites

Cross-Site Request Forgery (CSRF) vulnerability in WordPlus Better Messages plugin <= 1.9.9.148 at WordPress allows attackers to upload files. File attachment to messages must be activated.

CVE-2022-29454: Better Messages – Live Chat for WordPress, BuddyPress, BuddyBoss, Ultimate Member, PeepSo

Authenticated (admin or higher user role) Reflected Cross-Site Scripting (XSS) vulnerability in ThingsForRestaurants Quick Restaurant Reservations plugin <= 1.4.1 at WordPress.

*   Details
*   Reviews
*   Installation
*   Support
*   Development

> Quick Restaurant Reservations is the easiest way to manage your restaurant bookings. Confirm / Reject reservations and send notifications to your customers. Manage several schedules, dates and time intervals.

**Quick Restaurant Reservations Features**

The plugin uses default WordPress functionality. Creates custom post types for Restaurants, Bookings and Clients.

*   Unlimited bookings
*   Bookings per restaurant
*   Pending, Confirm, Reject, Cancel status.
*   Notify customers about their booking status via email.
*   Manual confirmation.
*   Define min / max party
*   Early / Late bookings
*   Date format
*   Custom message after form submitted
*   Custom redirect after form submitted
*   Unlimited schedules
*   Schedule status open / close
*   Define week days and time interval for each schedule
*   Customize email notifications (admin, pending, confirmed, rejected, update)
*   Clients list
*   Form fields: date, party, time, name, email, phone, message

**ADD-ONS Features**

*   Unlimited restaurants
*   Each restaurant has its own page and booking form
*   Automatic confirmations
*   Set max capacity based on number of seats
*   Set max capacity based on tables
*   Limit automatic confirmation to max party
*   Limit automatic confirmation until X seats reached
*   Customize logo of email notifications
*   Monthly calendar view
*   Daily calendar view
*   Unlimited form custom fields

Make sure to review our ADD-ONS for Quick Restaurant Reservations page for more detailed information.

**How to use**

Add the shortcode of the restaurant form in any existing post or page:

    [qrr_form id="123"]
    

**Translations**

1.  Unzip the plugin and upload it to your site’s wp-content/plugins/ folder.
2.  Activate Quick Restaurant Reservations trough the “plugins” area in your WordPress dashboard
3.  A new menu item called “Rest. Bookings” will appear in your dashboard navigation.
4.  Go there and create a new restaurant.
5.  Define schedules for the restaurant.
6.  Copy and paste the shortcode for the bookings form in another page content.

**How do I create a booking form?**

Create a new restaurant.  
Define schedules for the restaurant.  
Insert the shortcode on any post or page.

Purchased the Capacity add on and it didn't work. We had a maximum set and we could just keep adding bookings endlessly. It didn't close off the numbers. Contacted support, no reply after a month. Put in another support ticket and asked for a refund. Same thing, no refund and no reply. We have to delete the whole plugin from our site because the capacity won't work.

I tested others plugins, this is very simple and complete. Other popular plugins don't work as well as this one.

This plugin is easy to implement and to customize.

I had a few challenges in a Wordpress multi-site environment, with a chain of 5 restaurants, each offering different arrangements on different times, different opening hours etcetera. I tried quite a few other plugins, but this one is by far the best! Support was great, even after more than several (beginner) questions, each was answered quickly and politely and the few issues that arose from this difficult setup were dealt with swiftly... Truly a 5-star review!

I love this plugin. It is exactly what I was looking for. It allows you change tags and personalize notifications. However, I couldn't edit the button text. Is it possible to do that?

Read all 8 reviews

“Quick Restaurant Reservations” is open source software. The following people have contributed to this plugin.

Contributors

*    Alejandro

**1.5.2**

*   Bulk action Cancel fixed

**1.5.1**

*   Fixed issue bulk updating bookings

**1.5.0**

*   Fixed issue email not saving format
*   Fixes issue in clients list layout

**1.4.8**

*   Fixed booking create status dropdown
*   Added new column for tables assigned

**1.4.7**

*   Fixed booking Action Selector dropdown

**1.4.6**

*   Fixed problem with emails layout

**1.4.5**

*   Fixed issue restaurant settings not saved

**1.4.4**

*   Fixed some bugs

**1.3.6**

*   Added time to Closed schedules
*   Can be closed full day or specific time

**1.3.5**

*   Fix issue with min booking duration
*   Fix issue with link to cancel booking
*   Added new column ‘Duration’
*   Integration with add-on ‘Capacity’ to export CSV

**1.3.3**

*   Added NL translation thanks to Bjron

**1.3.2**

*   Fixed issue for deleting trash old booking
*   Added booking column ID

**1.3.1**

*   Small issue with the front reservation ajax action

**1.3.0**

*   The admin table bookings has a default view for Today/Future bookings
*   New filter for Today or Future reservations at the admin table bookings list
*   New filter ‘qrr\_admin\_booking\_column\_date’ for changing the admin column Date format
*   Fixed issue calendar flickering at the front-end

**1.2.8**

*   Fixed issue with i18n date

**1.2.7**

*   Fixed small issues with front-form.php template
*   Added new filters to remove all other metaboxes from CPTs
*   filter: qrr\_restaurant\_remove\_all\_other\_metaboxes (default false)
*   filter: qrr\_client\_remove\_all\_other\_metaboxes (default false)
*   filter: qrr\_booking\_remove\_all\_other\_metaboxes (default false)

**1.2.6**

*   Fixed date translation inside the emails sent

**1.2.5**

*   Fixed action links from email sent to administrator (confirm, reject, calcel booking)
*   Added early booking new options (1 and 2 years in advance)

**1.2.0**

*   Solved bug when sending emails from admin bookings panel

**1.1.5**

*   Hours format: 24h / 12H
*   Small bugs fixed
*   Default admin email set if field is empty
*   Form date picker with >40 available translations

**1.0.5**

*   Bookings list filtering by date and restaurant.
*   Bookings list ordered by date.

**1.0.0**

*   Plugin released.

CVE-2022-29923: Quick Restaurant Reservations

Authenticated (admin+) Stored Cross-Site Scripting (XSS) vulnerability in René Hermenau's Social Media Share Buttons plugin <= 3.8.1 at WordPress.

 Verified

 Not fixed

**3.4**

CVSS 3.1 score Low severity

Monitoring Coming soon

Vulnerable versions

<= 3.8.1

PSID 

cf86e8d15058

Classification 

Cross Site Scripting (XSS)

OWASP Top 10 

A7: Cross-Site Scripting (XSS)

Required privilege 

Requires high role user authentication like admin.

Publicly disclosed

2022-06-16

**Details**

Authenticated Stored Cross-Site Scripting (XSS) vulnerability discovered by Asif Nawaz Minhas (Patchstack Alliance) in WordPress Social Media Share Buttons plugin (versions <= 3.8.1).

**Solution**

No patched version available. No reply from the vendor.

**References**

Tag

#wordpress