{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/vendors/the-food-store/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:the_food_store:online_food_delivery_\u0026_pickup:*:*:*:*:*:wordpress:*:*"],"_cs_cves":[{"cvss":7.2,"id":"CVE-2026-96669"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["The Food Store – Online Food Delivery \u0026 Pickup (\u003c= 1.5.5)"],"_cs_severities":["high"],"_cs_tags":[],"_cs_type":"advisory","_cs_vendors":["The Food Store"],"content_html":"\u003cp\u003eThe Food Store - Online Food Delivery \u0026amp; Pickup plugin for WordPress (versions 1.5.5 and earlier) suffers from a stored cross-site scripting (XSS) vulnerability due to improper input sanitization and output escaping. An unauthenticated attacker can supply a malicious payload through the 'type' query parameter on the public checkout page, which the plugin subsequently writes into the 'service_type' browser cookie. This value is persisted into the order metadata and is executed when an administrator views the order within the WordPress dashboard.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eAttacker navigates to the public checkout page of the vulnerable WordPress site.\u003c/li\u003e\n\u003cli\u003eAttacker appends a malicious XSS payload to the 'type' query parameter (e.g., ?type=\u0026lt;script\u0026gt;alert(1)\u0026lt;/script\u0026gt;).\u003c/li\u003e\n\u003cli\u003eThe plugin processes the input and sets the 'service_type' cookie in the user's browser with the malicious payload.\u003c/li\u003e\n\u003cli\u003eThe malicious payload is stored in the WordPress database within the order metadata.\u003c/li\u003e\n\u003cli\u003eAn administrator accesses the WordPress admin panel to view the order details.\u003c/li\u003e\n\u003cli\u003eThe WordPress dashboard renders the order metadata, triggering the execution of the stored malicious script in the administrator's browser context.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows for the execution of arbitrary JavaScript in the context of an administrator's session. This may lead to unauthorized administrative actions, session hijacking, or further compromise of the WordPress site.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eUpgrade The Food Store - Online Food Delivery \u0026amp; Pickup plugin to a version released after 1.5.5 that contains the security fix.\u003c/li\u003e\n\u003cli\u003eUntil a patch is applied, implement a Web Application Firewall (WAF) rule to inspect and block suspicious input in the 'type' query parameter on the checkout page.\u003c/li\u003e\n\u003cli\u003eReview WordPress audit logs for unexpected administrative activities or modified order metadata.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-10-29T05:03:49Z","date_published":"2026-10-29T05:03:49Z","id":"https://feed.craftedsignal.io/briefs/2026-10-food-store-xss/","summary":"The Food Store - Online Food Delivery \u0026 Pickup WordPress plugin version 1.5.5 and earlier contains a stored cross-site scripting vulnerability allowing unauthenticated attackers to inject malicious scripts into administrative panels via the service_type cookie.","title":"The Food Store WordPress plugin: Stored Cross-Site Scripting (CVE-2026-96669)","url":"https://feed.craftedsignal.io/briefs/2026-10-food-store-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - The Food Store","version":"https://jsonfeed.org/version/1.1"}