Stored Cross-Site Scripting Vulnerability in Responsive Food and Drink Menu by WordPress

CVE-2025-6378

What is CVE-2025-6378?

The Responsive Food and Drink Menu plugin for WordPress can be exploited due to a Stored Cross-Site Scripting vulnerability. This issue arises from inadequate input sanitization and output escaping for user-supplied attributes via the plugin's display_pdf_menus shortcode. As a result, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which execute whenever an unsuspecting user accesses these manipulated pages. It is crucial for users of this plugin to remain vigilant and ensure that they are running the most updated version to mitigate potential risks.

References