Food Store CVE-2026-116622

Exploitation requires a specific non-default configuration: the 'Enable Checkout Service Fields' option must be turned OFF while 'Enable Pickup/Delivery Service' remains enabled; only then is attacker-controlled input to the 'service_time' parameter stored and rendered without sanitization or output escaping. The injection step itself needs no authentication (CVSS PR:N) and no user interaction to store the payload, but execution occurs only when some user subsequently accesses the injected page. The main limiting factor is the non-default configuration requirement, which is outside the attacker's control and excludes default-configured installations; impact is bounded to the browser context of users viewing the affected page.

This is a stored XSS (CWE-79) in the Food Store WordPress plugin, scored CVSS 7.2 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N - network-reachable, no privileges, no user interaction, with a changed scope reflecting script execution in a different security context (the victim's browser/other users). The vuln.today decision label is 'this_week' (not act_now/emergency), indicating elevated but non-emergency priority. No EPSS score, no CISA KEV listing, and no PoC/exploit indicator were supplied in the input, so there is no signal of active exploitation or published exploit code - the references are a Wordfence advisory and WordPress plugin source-code lines, not working exploit code. The most important nuance contradicting the raw PR:N/AC:L reading is in the description: exploitation requires the site to have 'Enable Checkout Service Fields' turned OFF, which is explicitly a NON-DEFAULT configuration, while 'Enable Pickup/Delivery Service' remains enabled. That precondition is outside the attacker's control and materially reduces the realistic attack surface, so despite a 7.2/'High' nominal severity this behaves more like a conditional issue affecting a subset of deployments than a universally exploitable default-config flaw. Combined with the plugin's small deployment footprint, real-world priority is moderate rather than urgent.

On a Food Store site misconfigured with 'Enable Checkout Service Fields' disabled but Pickup/Delivery Service enabled, an unauthenticated attacker submits a crafted 'service_time' value containing a web script. Because the input is neither sanitized on entry nor escaped on output, the payload is stored and later rendered, executing in the browser of any user (potentially an administrator) who views the injected page. No public exploit was identified in the provided data; the attack would use a standard stored-XSS payload against the vulnerable parameter.