The Food Store WordPress plugin: Stored Cross-Site Scripting (CVE-2026-116622)
The Food Store WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting via the service_time parameter in versions up to 1.5.5, allowing attackers to inject malicious scripts into administrative or user-facing pages.
CVE search metadata
CVE search record: CVE-2026-116622. Severity: high. CVSS: 7.2. KEV: no. Product: The Food Store – Online Food Delivery & Pickup (<= 1.5.5). Brief: The Food Store WordPress plugin: Stored Cross-Site Scripting (CVE-2026-116622). Brief link: https://feed.craftedsignal.io/briefs/2026-10-food-store-xss-0425c09a/
Triage facts
Revision 1- Applicability
- The Food Store – Online Food Delivery & Pickup (<= 1.5.5)
- Evidence
- Unknown
- Severity
- High
- Action
- Elevated
- Sources
- 1 public source
- Freshness
- Revision 1Oct 30, 09:26 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
The Food Store - Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'service_time' parameter. The vulnerability stems from insufficient input sanitization and output escaping. An unauthenticated attacker can exploit this to inject arbitrary JavaScript that executes in the context of a user's browser session.
The vulnerability is exploitable only under a specific non-default configuration: the 'Enable Checkout Service Fields' option must be disabled, while the 'Enable Pickup/Delivery Service' option must be enabled.
Impact
Successful exploitation allows for the execution of arbitrary web scripts in the browser of a victim, such as an administrator, which could lead to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious content.
Recommendation
- Upgrade "The Food Store - Online Food Delivery & Pickup" plugin to the latest version beyond 1.5.5 immediately.
- If an update is unavailable, temporarily disable the 'Enable Pickup/Delivery Service' setting until a patch is applied.
- Review WordPress audit logs for unusual POST requests targeting 'service_time' parameters.
Immediate actions
Upgrade The Food Store plugin to the latest version to patch CVE-2026-116622
Threat Hunt
Search web server access logs for POST requests containing script tags or JavaScript event handlers in the request body for the service_time parameter.
Data: Web server access logs (e.g., Apache/Nginx access.log)
Mitigations
Disable Enable Pickup/Delivery Service in plugin configuration
CVE-2026-116622