Stored XSS in Restaurant Menu and Food Ordering Plugin for WordPress

The Restaurant Menu and Food Ordering plugin for WordPress (versions 2.4.14 and earlier) contains a Stored Cross-Site Scripting (XSS) vulnerability. The flaw exists because the plugin fails to properly sanitize input or escape output for the 'phone_number' parameter before storing it in the database and displaying it to users. An unauthenticated attacker can exploit this by submitting a crafted HTTP request containing malicious JavaScript payloads into the plugin's data fields. When an administrative user later accesses the infected page or dashboard view where the malicious data is rendered, the script executes within their browser session. This could allow an attacker to perform actions on behalf of the administrator, such as creating new rogue accounts, changing plugin settings, or redirecting traffic.

Impact

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in the context of an administrator's browser. This can lead to full site compromise, unauthorized administrative actions, or the theft of session cookies. The impact is elevated given the plugin is typically used for order processing, which may contain sensitive customer or financial data.

Recommendation

Update the Restaurant Menu and Food Ordering plugin for WordPress to the latest version immediately to remediate the lack of input sanitization. Since there is no patch information provided in the source, users should monitor the official WordPress plugin repository for updates and disable the plugin if an immediate fix is not available.