Stored Cross-Site Scripting in Food Store Online Food Delivery Plugin for WordPress

CVE-2026-116622

What is CVE-2026-116622?

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) through the 'service_time' parameter in all versions up to and including 1.5.5. Due to insufficient input validation and output escaping, unauthenticated attackers can exploit this vulnerability to inject arbitrary web scripts into the plugin's pages. This is particularly exploitable when the 'Enable Checkout Service Fields' option is disabled—though this is a non-default configuration—while 'Enable Pickup/Delivery Service' remains active, allowing attackers to execute malicious scripts when a user accesses an affected page.

References