CVE-2024-9458 — Reservit Hotel < 3.0 - Admin+ Stored XSS

Back Back to CVE browser

MEDIUM

Reservit Hotel < 3.0 - Admin+ Stored XSS

Published Mar 7, 2025

4.8

MEDIUM

CVSS 3.1

EPSS 0.89%

Description

The Reservit Hotel WordPress plugin before 3.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup).

Affected products

Vendor n/a Product Reservit Hotel Default
unaffected
- Version
  0
  Status
  affected
  Constraints
  <3.0

Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).

Vendor

Product

Default status

Versions

n/a

Reservit Hotel

unaffected

Version	Status	Constraints
0	affected	<3.0

Remediation

No remediation recorded yet.

Metrics

0.89% 0.00891

Estimated probability of exploitation in the wild in the next 30 days (FIRST EPSS). As of Oct 3, 2026.

EPSS probability 0.00891

Score over time

2025–2026

EPSS v3
EPSS v4
EPSS v5

Percentile over time

EPSS v3
EPSS v4
EPSS v5

Table of values (9 key points)

Flat stretches are collapsed; showing up to 120 newest points.

Date	Score	Percentile	Model
Oct 3, 2026	0.89% (0.00891)	58.00th	v5 (v2026.06.15)
Jun 15, 2026	0.83% (0.00830)	52.60th	v5 (v2026.06.15)
May 16, 2026	1.66% (0.01664)	82.28th	v4 (v2025.03.14)
Feb 18, 2026	0.66% (0.00661)	70.69th	v4 (v2025.03.14)
Nov 21, 2025	2.14% (0.02135)	83.63th	v4 (v2025.03.14)
Nov 18, 2025	4.26% (0.04262)	87.69th	v4 (v2025.03.14)
Apr 7, 2025	1.24% (0.01243)	77.53th	v4 (v2025.03.14)
Mar 17, 2025	0.03% (0.00029)	5.27th	v4 (v2025.03.14)
Mar 8, 2025	0.04% (0.00043)	11.87th	v3 (v2023.03.01)