GloriaFood Restaurant Menu EUVD-2026-108081

Exploitation requires the attacker to already hold a valid low-privileged WordPress account on the target site (PR:L) that can submit data into one of the plugin's stored fields, and successful script execution additionally requires a separate user (such as an administrator) to subsequently view the page containing the stored payload (UI:R). This dependency on both prior authentication and victim interaction materially limits exploitability; it is not remotely exploitable against an unauthenticated anonymous attacker. The specific input field and the precise sanitization gap are not detailed in the available sources beyond the generic stored XSS description. The scope change (S:C) reflects that the injected code runs in the victim's browser/session rather than the vulnerable application's own context.

This is a moderate, not emergency, priority. The input CVSS of 6.5 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L) describes a network-reachable but authenticated (PR:L) stored XSS that additionally requires victim interaction (UI:R) and yields only Low confidentiality, integrity, and availability impact, with a scope change (S:C) reflecting that injected script executes in another user's browser context. No EPSS score, no CISA KEV listing, and no SSVC automatable/technical-impact values were supplied, so those signals cannot be weighed; the only decision signal present is the vuln.today priority label 'this_month', which is consistent with a real-but-not-urgent stored XSS rather than mass exploitation. The reference is a Patchstack database advisory, not verified working exploit code, so there is no public exploit identified at time of analysis. Net: a genuine finding worth scheduled patching, but the authentication-plus-interaction requirement and Low impacts place it well below critical, drive-by-exploited bugs.

An attacker holding a low-privileged WordPress account (e.g., a contributor or customer-level role) on a site running this plugin submits content - such as a menu item, reservation, or order field - containing a malicious script payload that is stored by the plugin. When an administrator or other user later views that stored data in the dashboard or on a page, the script executes in their browser session. No verified public exploit code exists, only a Patchstack advisory reference.