{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3athe_food_store_projectthe_food_storewordpress/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:the_food_store_project:the_food_store:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-116622"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["The Food Store – Online Food Delivery \u0026 Pickup (\u003c= 1.5.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["WordPress"],"content_html":"\u003cp\u003eThe Food Store - Online Food Delivery \u0026amp; Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'service_time' parameter. The vulnerability stems from insufficient input sanitization and output escaping. An unauthenticated attacker can exploit this to inject arbitrary JavaScript that executes in the context of a user's browser session.\u003c/p\u003e\n\u003cp\u003eThe vulnerability is exploitable only under a specific non-default configuration: the 'Enable Checkout Service Fields' option must be disabled, while the 'Enable Pickup/Delivery Service' option must be enabled.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary web scripts in the browser of a victim, such as an administrator, which could lead to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious content.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade \u0026quot;The Food Store - Online Food Delivery \u0026amp; Pickup\u0026quot; plugin to the latest version beyond 1.5.5 immediately.\u003c/li\u003e\n\u003cli\u003eIf an update is unavailable, temporarily disable the 'Enable Pickup/Delivery Service' setting until a patch is applied.\u003c/li\u003e\n\u003cli\u003eReview WordPress audit logs for unusual POST requests targeting 'service_time' parameters.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-30T09:26:57Z","date_published":"2026-10-30T09:26:57Z","id":"https://feed.craftedsignal.io/briefs/2026-10-food-store-xss-0425c09a/","summary":"The Food Store WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting via the service_time parameter in versions up to 1.5.5, allowing attackers to inject malicious scripts into administrative or user-facing pages.","title":"The Food Store WordPress plugin: Stored Cross-Site Scripting (CVE-2026-116622)","url":"https://feed.craftedsignal.io/briefs/2026-10-food-store-xss-0425c09a/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:the_food_store_project:the_food_store:*:*:*:*:*:wordpress:*:*","version":"https://jsonfeed.org/version/1.1"}