Food Store Online Food Delivery Pickup
Monthly
Stored cross-site scripting in the Food Store WordPress plugin through 1.5.5 allows unauthenticated attackers to inject script through the 'service_time' parameter when the 'Enable Checkout Service Fields' option is turned off and 'Enable Pickup/Delivery Service' remains enabled. The payload is stored without sufficient sanitization and later rendered without output escaping, so it executes in the browser of a user who accesses the injected page. The assessed severity is CVSS 7.2 with a changed-scope impact, but exploitation is limited by the required non-default configuration; no CISA KEV entry or public exploit code is identified in the supplied intelligence.
Unauthenticated stored cross-site scripting in the WordPress plugin Food Store - Online Food Delivery & Pickup through version 1.5.5 allows remote attackers to plant arbitrary JavaScript that later executes in a store administrator's browser session. The payload is seeded without authentication: an attacker supplies it in the ?type= query parameter on the plugin's public checkout page, the plugin copies that value verbatim into the visitor's service_type cookie, and the value is subsequently persisted into order meta and rendered without escaping inside wp-admin. Seeding is unrestricted, but execution requires a back-office user to open the poisoned order, and no public exploit was identified at time of analysis (the issue is not in CISA KEV).
Stored cross-site scripting in the Food Store WordPress plugin through 1.5.5 allows unauthenticated attackers to inject script through the 'service_time' parameter when the 'Enable Checkout Service Fields' option is turned off and 'Enable Pickup/Delivery Service' remains enabled. The payload is stored without sufficient sanitization and later rendered without output escaping, so it executes in the browser of a user who accesses the injected page. The assessed severity is CVSS 7.2 with a changed-scope impact, but exploitation is limited by the required non-default configuration; no CISA KEV entry or public exploit code is identified in the supplied intelligence.
Unauthenticated stored cross-site scripting in the WordPress plugin Food Store - Online Food Delivery & Pickup through version 1.5.5 allows remote attackers to plant arbitrary JavaScript that later executes in a store administrator's browser session. The payload is seeded without authentication: an attacker supplies it in the ?type= query parameter on the plugin's public checkout page, the plugin copies that value verbatim into the visitor's service_type cookie, and the value is subsequently persisted into order meta and rendered without escaping inside wp-admin. Seeding is unrestricted, but execution requires a back-office user to open the poisoned order, and no public exploit was identified at time of analysis (the issue is not in CISA KEV).