CVE-2022-2753

What it actually does

CVE-2022-2753 is a stored cross-site scripting vulnerability in the Ketchup Restaurant Reservations WordPress plugin through version 1.0.0. The plugin fails to properly sanitize and escape user-supplied reservation fields before storing and rendering them in the administrative interface. An unauthenticated attacker can submit a reservation containing JavaScript or HTML event-handler payloads; when a logged-in WordPress administrator views the malicious reservation, the script executes in the administrator’s browser context. Because the code runs as the administrator, it may read page content, perform actions available to that user, steal non-HttpOnly cookies or CSRF tokens if exposed, create new administrative users, modify plugin/theme files where permitted, or redirect the administrator to attacker-controlled infrastructure.

Why it matters to the business

Successful exploitation can compromise the WordPress administration session and may lead to unauthorized site changes, content injection, credential/session theft, defacement, malware placement, or full site takeover depending on administrator permissions and WordPress hardening. The vulnerability is unauthenticated, network-exploitable, and has public exploit availability with a high EPSS score, meaning exposed sites using the affected plugin should be treated as likely targets even though it is not listed in CISA KEV. Since no fixed version is provided, continued use of the affected plugin creates ongoing operational and reputational risk.

How an attack unfolds

An attacker first identifies a WordPress site using the Ketchup Restaurant Reservations plugin. They locate the public reservation submission functionality and submit a reservation containing a crafted JavaScript payload in one or more fields such as name, phone, email, notes, message, or other free-text reservation inputs. The plugin stores the reservation without sufficient sanitization. Later, a logged-in WordPress administrator or privileged staff member opens the reservation management page in wp-admin. The stored payload is rendered without proper output escaping and executes in the administrator’s browser. From there, the attacker’s script can perform actions in the administrator’s session, such as issuing authenticated WordPress requests, changing site settings, injecting malicious content, creating a new privileged user if nonce protections can be obtained or bypassed, or exfiltrating accessible data to an external endpoint.

How to fix it

Remove or disable the Ketchup Restaurant Reservations plugin if it is not required. The affected range is reported as versions through 1.0.0 and no fixed version is provided, so upgrading may not be sufficient unless the plugin maintainer has released a corrected version outside the available advisory data. If a maintained fixed release becomes available, upgrade immediately and verify that all reservation fields are sanitized on input and escaped on output. As interim mitigation, restrict access to the reservation submission endpoint where operationally possible, place the form behind authentication or anti-abuse controls, deploy a WAF rule to block common XSS payloads in reservation parameters, and limit WordPress administrator privileges. Review and remove suspicious reservations before administrators view them in a browser, preferably using direct database or CLI inspection with scripts rendered inert. Ensure WordPress core, themes, and all plugins are current, and enforce MFA for administrator accounts.

How to confirm the fix worked

Confirm whether the plugin is installed and determine its version by checking the WordPress plugins page, filesystem plugin metadata, or WP-CLI. Exposure is present if the Ketchup Restaurant Reservations plugin is active at version 1.0.0 or earlier and public reservation submission is enabled. After remediation, verify the plugin is removed, disabled, or updated to a release that demonstrably escapes reservation fields in the admin interface. Test safely in a staging environment by submitting a benign payload such as an encoded or inert HTML marker and confirming it is displayed as text rather than interpreted as markup or script in the admin reservation view. Review WAF and application logs to ensure reservation submissions with script tags, JavaScript URI schemes, and HTML event handlers are blocked or neutralized. Validate that no unexpected WordPress administrator users, plugin/theme modifications, or suspicious posts/pages were created during the exposure window.

Typical attack path

1. Scan for WordPress sites with the Ketchup Restaurant Reservations plugin installed or exposed reservation forms.
2. Submit a reservation containing a stored XSS payload in one or more user-controlled reservation fields.
3. Wait for a logged-in administrator or reservation manager to view the submitted reservation in the WordPress admin interface.
4. Execute JavaScript in the privileged user’s browser when the stored reservation is rendered.
5. Use the administrator session to perform unauthorized WordPress actions, steal accessible tokens or data, redirect the user, or stage further compromise.
6. Optionally establish persistence by creating content, adding users, modifying site configuration, or planting web-accessible malicious code if permissions allow.

How to detect it

Investigate historical exploitation by reviewing HTTP access logs, WAF logs, WordPress audit logs, plugin/application logs, and database-backed reservation records for malicious input submitted to reservation forms. Focus on unauthenticated POST requests to reservation-related endpoints containing HTML tags, script blocks, encoded JavaScript, SVG payloads, iframe tags, or event-handler attributes such as onerror and onload. Correlate suspicious reservation creation times with subsequent WordPress admin activity, including visits to reservation management pages, creation of new users, plugin or theme editor activity, option changes, post/page edits, file uploads, and unexpected outbound network connections from administrator workstations. Inspect active and historical administrator accounts for newly created or modified privileged users. Check webroot and wp-content directories for recently modified PHP files, injected JavaScript, suspicious uploads, or unfamiliar plugins. If browser telemetry is available, look for administrator sessions that loaded external domains immediately after viewing reservation records. Because this is stored XSS, the initial exploit artifact is often the malicious reservation content itself rather than a direct server-side code execution trace.

• wp-content/plugins/ketchup-restaurant-reservations/
• ketchup restaurant reservations
• <script
• %3Cscript
• </script>
• %3C%2Fscript%3E
• javascript:
• onerror=
• onload=
• onmouseover=
• onfocus=
• <iframe
• %3Ciframe
• <svg
• %3Csvg
• document.cookie
• document.location
• window.location
• eval(
• atob(
• fetch(
• XMLHttpRequest
• new Image().src
• wp-admin/plugin-editor.php
• wp-admin/theme-editor.php
• wp-admin/user-new.php
• wp-admin/admin-ajax.php

What your security team should do

• Immediately inventory WordPress sites for the Ketchup Restaurant Reservations plugin, prioritizing internet-facing sites.
• Disable or remove the plugin unless a verified patched version is available and installed.
• Treat affected active installations as high-priority because exploitation is unauthenticated, public exploit code is available, and EPSS is high.
• Review existing reservations for stored script, iframe, SVG, event-handler, or JavaScript URI payloads before allowing administrators to open reservation records in a browser.
• Search WordPress, web server, WAF, EDR, and administrator browser telemetry for evidence of malicious reservation submissions and subsequent privileged WordPress actions.
• Audit WordPress administrator accounts, recently created users, plugin/theme file changes, new posts/pages, injected scripts, and unexpected redirects.
• Enforce MFA and least privilege for WordPress administrators and remove unused privileged accounts.
• Add temporary WAF/SIEM detections for XSS payloads submitted to reservation endpoints and for suspicious outbound connections initiated from admin browsing sessions.
• If compromise is suspected, rotate administrator passwords, invalidate active sessions, rotate relevant API keys/secrets, and restore modified files from trusted sources.