The Food Store WordPress plugin: Stored Cross-Site Scripting (CVE-2026-96669)

The Food Store - Online Food Delivery & Pickup plugin for WordPress (versions 1.5.5 and earlier) suffers from a stored cross-site scripting (XSS) vulnerability due to improper input sanitization and output escaping. An unauthenticated attacker can supply a malicious payload through the 'type' query parameter on the public checkout page, which the plugin subsequently writes into the 'service_type' browser cookie. This value is persisted into the order metadata and is executed when an administrator views the order within the WordPress dashboard.

Attack Chain

1. Attacker navigates to the public checkout page of the vulnerable WordPress site.
2. Attacker appends a malicious XSS payload to the 'type' query parameter (e.g., ?type=<script>alert(1)</script>).
3. The plugin processes the input and sets the 'service_type' cookie in the user's browser with the malicious payload.
4. The malicious payload is stored in the WordPress database within the order metadata.
5. An administrator accesses the WordPress admin panel to view the order details.
6. The WordPress dashboard renders the order metadata, triggering the execution of the stored malicious script in the administrator's browser context.

Impact

Successful exploitation allows for the execution of arbitrary JavaScript in the context of an administrator's session. This may lead to unauthorized administrative actions, session hijacking, or further compromise of the WordPress site.

Recommendation

• Upgrade The Food Store - Online Food Delivery & Pickup plugin to a version released after 1.5.5 that contains the security fix.
• Until a patch is applied, implement a Web Application Firewall (WAF) rule to inspect and block suspicious input in the 'type' query parameter on the checkout page.
• Review WordPress audit logs for unexpected administrative activities or modified order metadata.