Stored Cross-Site Scripting Vulnerability in Restaurant Menu and Food Ordering Plugin for WordPress

CVE-2026-96568

What is CVE-2026-96568?

The Restaurant Menu and Food Ordering plugin for WordPress suffers from a vulnerability that allows stored cross-site scripting (XSS) via the 'phone_number' parameter. This flaw arises due to a lack of adequate input sanitization and output escaping, making it possible for unauthenticated users to insert and execute malicious web scripts on pages viewed by users accessing the compromised content. As a consequence, this vulnerability poses significant risks to the data and security of users visiting the affected pages.

References