Stored Cross-Site Scripting in Food Store Plugin for WordPress

CVE-2026-96669

What is CVE-2026-96669?

The Food Store – Online Food Delivery & Pickup plugin for WordPress contains a vulnerability that allows for Stored Cross-Site Scripting due to improper input sanitization and output escaping. Attackers can exploit this flaw by injecting malicious scripts via the 'service_type' cookie, specifically through the ?type= query parameter located on the public checkout page. This injected script is stored and later rendered unescaped in the admin panel, enabling attackers to execute arbitrary scripts in the browser whenever a user accesses the compromised page, potentially leading to information theft and other security incidents.

References