Food Menu Restaurant Menu Online Ordering For Woocommerce
Monthly
Unauthenticated cross-site scripting in the Food Menu - Restaurant Menu & Online Ordering for WooCommerce plugin (versions up to and including 6.0.5) lets attackers inject script that executes in the context of a victim's browser session on an affected WordPress/WooCommerce site. Affected deployments are any WordPress installation running the RadiusTheme plugin at version 6.0.5 or earlier; the attacker needs no credentials (CVSS PR:N) but the payload only fires when a victim loads attacker-influenced content (UI:R), so a privileged user such as an administrator is the highest-value target. There is no CISA KEV entry and no public exploit code identified in the supplied intelligence at time of analysis, and no EPSS score was provided; our independent assessment rates this as a genuine medium-tier issue rather than an emergency, with the vector (scope change S:C, low confidentiality/integrity/availability impact) internally consistent with a script-injection flaw. Patchstack is credited as the reporting source and hosts the reference advisory. Vendor-released patch: no fixed version identified in the available data.
Unauthenticated cross-site scripting in the Food Menu - Restaurant Menu & Online Ordering for WooCommerce plugin (versions up to and including 6.0.5) lets attackers inject script that executes in the context of a victim's browser session on an affected WordPress/WooCommerce site. Affected deployments are any WordPress installation running the RadiusTheme plugin at version 6.0.5 or earlier; the attacker needs no credentials (CVSS PR:N) but the payload only fires when a victim loads attacker-influenced content (UI:R), so a privileged user such as an administrator is the highest-value target. There is no CISA KEV entry and no public exploit code identified in the supplied intelligence at time of analysis, and no EPSS score was provided; our independent assessment rates this as a genuine medium-tier issue rather than an emergency, with the vector (scope change S:C, low confidentiality/integrity/availability impact) internally consistent with a script-injection flaw. Patchstack is credited as the reporting source and hosts the reference advisory. Vendor-released patch: no fixed version identified in the available data.