EUVD-2026-86597
GHSA-8f6r-2672-qg7f
Severity by source
AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Unauthenticated remote submission of the phone_number field (PR:N/AV:N/AC:L); stored script executes in the admin dashboard context, crossing a trust boundary (S:C) with limited C/I impact and no availability impact.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
3DescriptionCVE.org
The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Articles & Coverage 1
AnalysisAI
Stored cross-site scripting in the MP Restaurant Menu and Food Ordering plugin for WordPress (all versions up to and including 2.4.14) lets an unauthenticated remote attacker inject arbitrary JavaScript by submitting a crafted value in the 'phone_number' field of the public ordering flow, with a CVSS:3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The payload is persisted in the order record and executes in the browser of whoever later opens the poisoned order in the site dashboard - typically an administrator or staff member - so real-world impact is gated by a privileged victim viewing attacker-controlled order data. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitable against default configurations wherever the Restaurant Menu and Food Ordering plugin (≤2.4.14) is active with its public ordering/checkout functionality enabled - the attacker needs no account (PR:N) and simply submits the 'phone_number' field of an order. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but moderate-priority WordPress plugin flaw. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Update the plugin to the first release published after 2.4.14 that contains the vendor fix; the fix is visible as Trac changeset 3709808 in the mp-restaurant-menu repository (https://plugins.trac.wordpress.org/changeset?reponame=&old=3709808%40mp-restaurant-menu&new=3709808%40mp-restaurant-menu), so patch status is best described as 'Upstream fix available (PR/commit); released patched version not independently confirmed' - administrators should install the latest plugin version from WordPress.org and verify, by diffing the order-handling code, that 'phone_number' is now sanitized on save and escaped on output. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, confirm whether the MP Restaurant Menu and Food Ordering plugin is installed and, if so, whether the running version is 2.4.14 or earlier; where the public ordering flow is not business-critical, deactivate and remove the plugin immediately, and where it is required, deploy a web application firewall rule that strips or blocks script and HTML markup in the 'phone_number' parameter of the ordering endpoint, restrict dashboard access to the minimum staff who need it, and audit recent order records for injected script content. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
In PHP versions 7.1.x below 7.1.33, 7.2.x below 7.2.24 and 7.3.x below 7.3.11 in certain configurations of FPM setup it
sapi/cgi/cgi_main.c in PHP before 5.3.12 and 5.4.x before 5.4.2, when configured as a CGI script (aka php-cgi), does not
(1) boardData102.php, (2) boardData103.php, (3) boardDataJP.php, (4) boardDataNA.php, and (5) boardDataWW.php in Netgear
The '/common/download_agent_installer.php' script in the Quest KACE System Management Appliance 8.0.318 is accessible by
ProjectSend versions prior to r1720 are affected by an improper authentication vulnerability. Rated critical severity (C
Roundcube Webmail contains a critical PHP object deserialization vulnerability (CVE-2025-49113, CVSS 9.9) that allows au
Util/PHP/eval-stdin.php in PHPUnit before 4.8.28 and 5.x before 5.6.3 allows remote attackers to execute arbitrary PHP c
Palo Alto Networks PAN-OS management web interface contains an authentication bypass allowing unauthenticated attackers
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
Nagios XI version xi-5.7.5 is affected by OS command injection. Rated high severity (CVSS 8.8), this vulnerability is re
The get_referers function in /opt/ws/bin/sblistpack in Sophos Web Appliance before 3.7.9.1 and 3.8 before 3.8.1.1 allows
The Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today