CVE-2025-11496 is a stored cross-site scripting vulnerability in the Five Star Restaurant Reservations WordPress Booking Plugin by rustaurius. The vulnerability arises from insufficient input sanitization and output escaping of the 'rtb-name' parameter, allowing unauthenticated attackers to inject arbitrary web scripts. These scripts execute in the context of users visiting the injected pages, potentially compromising user data confidentiality and integrity. The vulnerability affects all plugin versions up to and including 2.7.5. The CVSS 3.1 base score is 6.1, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and scope change with partial confidentiality and integrity impact.

Successful exploitation can lead to execution of arbitrary scripts in users' browsers when they view affected pages, potentially allowing theft of user credentials, session tokens, or other sensitive information. The impact affects confidentiality and integrity but does not affect availability. The vulnerability requires user interaction (visiting a maliciously crafted page) and can be exploited by unauthenticated attackers.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider disabling or restricting access to the vulnerable plugin functionality, and apply web application firewall (WAF) rules to detect and block malicious input targeting the 'rtb-name' parameter. Monitor official rustaurius or WordPress plugin sources for updates and apply patches promptly once released.