Cpe:2.3:a:the_food_store_project:the_food_store:*:*:*:*:*:wordpress:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3athe_food_store_projectthe_food_storewordpress/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioFri, 30 Oct 2026 09:26:57 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgThe Food Store WordPress plugin: Stored Cross-Site Scripting (CVE-2026-116622)https://feed.craftedsignal.io/briefs/2026-10-food-store-xss-0425c09a/Fri, 30 Oct 2026 09:26:57 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-food-store-xss-0425c09a/The Food Store WordPress plugin is vulnerable to unauthenticated Stored Cross-Site Scripting via the service_time parameter in versions up to 1.5.5, allowing attackers to inject malicious scripts into administrative or user-facing pages.The Food Store - Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) via the 'service_time' parameter. The vulnerability stems from insufficient input sanitization and output escaping. An unauthenticated attacker can exploit this to inject arbitrary JavaScript that executes in the context of a user's browser session.

The vulnerability is exploitable only under a specific non-default configuration: the 'Enable Checkout Service Fields' option must be disabled, while the 'Enable Pickup/Delivery Service' option must be enabled.

Impact

Successful exploitation allows for the execution of arbitrary web scripts in the browser of a victim, such as an administrator, which could lead to session hijacking, unauthorized actions performed on behalf of the user, or redirection to malicious content.

Recommendation

  • Upgrade "The Food Store - Online Food Delivery & Pickup" plugin to the latest version beyond 1.5.5 immediately.
  • If an update is unavailable, temporarily disable the 'Enable Pickup/Delivery Service' setting until a patch is applied.
  • Review WordPress audit logs for unusual POST requests targeting 'service_time' parameters.
]]>highadvisory