CVE-2026-96568

HighCVSS 7.2

Published: 25/09/2026(UTC)Updated: 25/09/2026(UTC)Translated: 25/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

14th percentile - higher than 14% of all known CVEs

Summary

The Restaurant Menu and Food Ordering plugin for WordPress (up to and including 2.4.14) is vulnerable to Stored Cross-Site Scripting (XSS) via the 'phone_number' parameter due to insufficient input sanitization and output escaping. This allows unauthenticated attackers to inject arbitrary web scripts into pages that execute when a user visits the injected page.

Risk Assessment

Attackers can execute arbitrary JavaScript in the user's browser, leading to session theft, redirects, or other drive-by attacks.

Recommendation

Update the Restaurant Menu and Food Ordering plugin to a version newer than 2.4.14. If update is not possible, implement additional input sanitization and output escaping.

Other vulnerabilities in Restaurant Menu and Food Ordering

CVE-2026-84044Medium
The Restaurant Menu and Food Ordering WordPress plugin before 2.4.12 does not verify that a PayPal payment notification genuinely originates from PayPal, allowing unauthenticated attackers to forge a payment notification and mark their own order as paid and completed without making any payment.

Original NVD description (English source)

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS