CVE-2025-52746
BaseFortify
Publication date: 2026-01-22
Last updated on: 2026-04-27
Assigner: Patchstack
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| ayecode | restaurante | to 3.0.7 (inc) |
| ayecode | restaurante | 3.1.1 |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-52746 is a medium severity Cross Site Scripting (XSS) vulnerability in the WordPress Restaurante Theme up to version 3.0.7. It allows an attacker to inject malicious scripts, such as redirects or advertisements, that execute when visitors access the compromised site. The vulnerability is a reflected XSS, meaning the malicious script is reflected off the web server, and exploitation requires a privileged user to interact with a crafted link, page, or form. No authentication is needed to initiate the attack, but user interaction is necessary. [1]
How can this vulnerability impact me? :
This vulnerability can lead to attackers executing malicious scripts in the context of the affected website, potentially redirecting users to malicious sites, displaying unwanted advertisements, or stealing sensitive information such as session cookies. This can compromise user trust, lead to data theft, and allow further attacks on users or the website itself. Since exploitation requires user interaction by a privileged user, it can also lead to unauthorized actions performed with elevated privileges. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by monitoring for attempts to inject malicious scripts or unusual HTML payloads in web requests targeting the Restaurante Theme up to version 3.0.7. Detection can involve inspecting HTTP requests for suspicious parameters or payloads that could trigger reflected XSS. While specific commands are not provided, using web application firewalls (WAF) with rules targeting this vulnerability or tools that scan for reflected XSS in web applications can help detect exploitation attempts. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include updating the Restaurante Theme to version 3.1.1 or later, where the vulnerability is fixed. Until the update can be applied, users can deploy Patchstack rules that block attacks targeting this vulnerability to provide protection. Additionally, monitoring and restricting user interactions that could trigger the vulnerability, such as clicking untrusted links or submitting untrusted forms, can reduce risk. [1]