Description

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.2",
  "pubDate": "2026-09-25T08:16:42.567Z",
  "pubdate": "2026-09-25T08:16:42.567Z",
  "executiveSummary": "The Restaurant Menu and Food Ordering plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability. This security flaw exists due to inadequate sanitization of user-supplied data within the 'phone_number' parameter.\nThe vulnerability allows unauthenticated remote attackers to inject malicious JavaScript payloads directly into the application's database. When a site administrator or privileged user views the injected content, the script executes within the context of the victim's browser session.\nThe impact of this vulnerability is significant, as it enables unauthorized actors to hijack user sessions, perform actions on behalf of the victim, access sensitive data, or redirect users to malicious external domains. Given the nature of Stored XSS, the payload persists across subsequent requests, creating a long-term threat for site management interfaces. There are no authentication requirements for exploitation, increasing the risk level for all installations running affected versions up to and including 2.4.14.",
  "technicalDetails": "The vulnerability is rooted in a failure to implement robust input validation and context-aware output encoding on the 'phone_number' parameter handled by the Restaurant Menu and Food Ordering plugin. In the affected versions (2.4.14 and earlier), the plugin processes this parameter during the ordering flow and persists the raw input into the database without stripping or neutralizing executable script tags or event handlers.\nThe attack flow begins when an unauthenticated attacker submits an order request containing a crafted payload within the 'phone_number' field. Since the application does not validate that the input contains only numeric or phone-specific characters, the malicious string—such as <script>alert(document.cookie)</script> or an obfuscated redirection script—is saved directly to the database entry associated with the order.\nThe exploitation mechanism relies on the server-side rendering of this stored data. When an administrator or staff member accesses the plugin's order management dashboard, the vulnerable component renders the stored 'phone_number' string into the DOM without appropriate escaping functions, such as esc_html() or esc_js(). Consequently, the browser interprets the injected payload as executable code.\nBecause the execution occurs within the context of the administrator's authenticated session, the malicious script inherits the victim's privileges. This allows the attacker to bypass administrative security controls. Post-exploitation activities may include the unauthorized modification of plugin settings, the creation of new administrative user accounts, the exfiltration of sensitive configuration data, or the injection of persistent malicious content into other areas of the WordPress installation to propagate the attack.\nThe lack of authentication requirements and the nature of the storage process make this a high-impact persistent threat, as any unauthenticated user can trigger the stored payload simply by placing an order. The persistence ensures that the exploit remains active until the specific database record is manually cleared or the input is sanitized by a security patch."
}