CVE-2026-116622
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Food Store – Online Food Delivery & Pickup plugin for WordPress in versions up to and including 1.5.5 is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter due to insufficient input sanitization and output escaping. Unauthenticated attackers can inject arbitrary web scripts into pages that execute when a user accesses the injected page. Exploitation requires the 'Enable Checkout Service Fields' option to be turned off (a non-default configuration) while 'Enable Pickup/Delivery Service' remains enabled.
Risk Assessment
Malicious script execution in the browser of a user visiting the page may lead to session data theft or other actions in the victim's context.
Recommendation
Update the Food Store plugin to a version later than 1.5.5 and avoid the described configuration until the fix is applied.
Other vulnerabilities in Food Store – Online Food Delivery & Pickup
Original NVD description (English source)
The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site to have the 'Enable Checkout Service Fields' option turned off, which is a non-default configuration, while 'Enable Pickup/Delivery Service' remains enabled.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS