CVE-2021-24299

CVE-2021-24299 is a stored Cross-Site Scripting (XSS) vulnerability in the ReDi Restaurant Reservation WordPress plugin prior to version 21.0426. An unauthenticated attacker can inject malicious scripts into the 'Comment' field of the reservation form. These scripts execute when a plugin user views the 'Upcoming' reservations page, which loads an external site in an iframe. The vulnerability has a CVSS score of 6.1 (Medium), indicating a network-based attack with low complexity, requiring user interaction, and leading to low confidentiality and integrity impacts. Its FAUCET Risk Score is 81/100. While not listed on CISA's KEV or Hot List, an exploit is available on ExploitDB. Community discussion and media coverage are present, though not extensive, suggesting some awareness but not widespread active exploitation.