Restaurant Menu And Food Ordering
Monthly
Stored cross-site scripting in the MP Restaurant Menu and Food Ordering plugin for WordPress (all versions up to and including 2.4.14) lets an unauthenticated remote attacker inject arbitrary JavaScript by submitting a crafted value in the 'phone_number' field of the public ordering flow, with a CVSS:3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The payload is persisted in the order record and executes in the browser of whoever later opens the poisoned order in the site dashboard - typically an administrator or staff member - so real-world impact is gated by a privileged victim viewing attacker-controlled order data. Per the available intelligence, exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no public proof-of-concept, and exploitation only requires the plugin to be active with its ordering/checkout functionality publicly reachable.
Stored cross-site scripting in the MP Restaurant Menu and Food Ordering plugin for WordPress (all versions up to and including 2.4.14) lets an unauthenticated remote attacker inject arbitrary JavaScript by submitting a crafted value in the 'phone_number' field of the public ordering flow, with a CVSS:3.1 base score of 7.2 (AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N). The payload is persisted in the order record and executes in the browser of whoever later opens the poisoned order in the site dashboard - typically an administrator or staff member - so real-world impact is gated by a privileged victim viewing attacker-controlled order data. Per the available intelligence, exploitation status is 'no public exploit identified at time of analysis' - there is no CISA KEV listing and no public proof-of-concept, and exploitation only requires the plugin to be active with its ordering/checkout functionality publicly reachable.