Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,007 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · restropress
RestroPress
10 known vulnerabilities on record. Add your version above to see which ones affect you.
Sep 21, 2026RestroPress: Does not validate a client-supplied item add-on price on the server sideCVE-2026-85010 · fixed in 3.4.6 · reported by WPScanMedium 5.3
The RestroPress WordPress plugin before 3.4.6 does not validate a client-supplied item add-on price on the server side when items are added to or updated in the cart, allowing unauthenticated users to set an arbitrary price and place orders for an attacker-chosen total, down to and including zero.
Sep 18, 2026RestroPress: Does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifierCVE-2026-85009 · affects up to 3.4.6 · reported by WPScanMedium 6.5
The RestroPress WordPress plugin through 3.4.6 does not verify ownership in its payment-recovery flow before acting on a request-supplied order identifier, allowing unauthenticated attackers to enumerate which orders are in a recoverable state and to write notes to another customer's order.
Dec 31, 2025RestroPress: Missing AuthorizationCVE-2025-62129 · affects up to 3.2.7 · reported by PatchstackMedium 5.3
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.7.
Dec 30, 2025RestroPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-69017 · affects up to 3.2.8.6 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Stored XSS.This issue affects RestroPress: from n/a through <= 3.2.8.6.
Dec 18, 2025RestroPress: Missing AuthorizationCVE-2025-66100 · affects up to 3.2.3.5 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.3.5.
Oct 3, 2025RestroPress – Online Food Ordering System: Authentication BypassCVE-2025-9209 · affects 3.0.0 to 3.1.9.2 · reported by WordfenceCritical 9.8
The RestroPress – Online Food Ordering System plugin for WordPress is vulnerable to Authentication Bypass in versions 3.0.0 to 3.1.9.2. This is due to the plugin exposing user private tokens and API data via the /wp-json/wp/v2/users REST API endpoint. This makes it possible for unauthenticated attackers to forge JWT tokens for other users, including administrators, and authenticate as them.
Apr 11, 2025RestroPress: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-32553 · affects up to 3.2.8.4 · reported by PatchstackHigh 7.1
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Magnigenie RestroPress restropress allows Reflected XSS.This issue affects RestroPress: from n/a through <= 3.2.8.4.
Apr 1, 2025RestroPress: Missing AuthorizationCVE-2025-31877 · affects up to 3.2.8 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Magnigenie RestroPress restropress allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects RestroPress: from n/a through <= 3.2.8.
Jun 8, 2024RestroPress: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-35719 · affects up to 3.1.2.1 · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in MagniGenie RestroPress allows Stored XSS.This issue affects RestroPress: from n/a through 3.1.2.1.
Apr 15, 2024RestroPress: Cross-Site Request Forgery (CSRF)CVE-2024-32449 · affects up to 3.1.2 · reported by PatchstackMedium 5.4
Cross-Site Request Forgery (CSRF) vulnerability in MagniGenie RestroPress.This issue affects RestroPress: from n/a through 3.1.2.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.