Food Menu CVE-2026-42709

Exploitation requires the Food Menu - Restaurant Menu & Online Ordering for WooCommerce plugin (version 6.0.5 or earlier) installed on a WordPress/WooCommerce site, and - per the CVSS UI:R metric - requires a victim to interact with attacker-controlled content (e.g., clicking a crafted link or viewing a page containing the injected payload). No authentication is required of the attacker (PR:N), so the entry point is reachable by anonymous users, but the limiting factor is that impact only materializes when a user (ideally a privileged one) loads the malicious content; no payoff occurs without that interaction. The description does not name a specific feature or non-default setting as a precondition, so exploitation appears tied to the plugin's standard menu/ordering input handling rather than an optional configuration mode.

This is a genuinely medium-tier issue rather than a top-priority emergency, and the signals are internally consistent. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, 7.1) describes an unauthenticated, network-reachable XSS that is low-complexity but requires victim user interaction and yields only Low impact to each of confidentiality, integrity, and availability - the elevated score is driven primarily by the scope change (S:C), typical of XSS where injected script executes in a separate security context (the victim's browser). No EPSS probability was supplied in the input, the CVE is not listed in CISA KEV, and no public proof-of-concept is referenced (only the Patchstack database advisory), so the correct exploitation status is 'no public exploit identified at time of analysis.' There is no conflict between the signals, but the ABSENCE of EPSS/KEV/POC data means real-world exploitation likelihood cannot be quantified from the input and must be treated as unknown rather than low. Net: a real but moderate web-application flaw whose impact is bounded by the need for user interaction and the Low (not High) CIA ratings.

An unauthenticated attacker crafts a URL or input that reflects/stores malicious JavaScript through the Food Menu plugin, then lures a logged-in site visitor or administrator into loading the affected page. When the victim's browser renders the page, the script executes in their session context, enabling actions such as cookie/session theft or forced administrative actions. No public exploit code is identified at time of analysis, and successful exploitation depends on the victim interacting with the attacker-supplied content.