CVE-2026-114700 in Restaurant Menu Plugin
Summary
by MITRE • 10/22/2026
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gloriafood Restaurant Menu – Food Ordering System – Table Reservation menu-ordering-reservations allows Stored XSS.This issue affects Restaurant Menu – Food Ordering System – Table Reservation: from n/a through 2.4.4.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/22/2026
The identified vulnerability represents a classic instance of Improper Neutralization of Input During Web Page Generation, commonly known as Cross-Site Scripting or XSS. Specifically, this is classified as a Stored XSS flaw within the Gloriafood Restaurant Menu and Food Ordering System software, covering versions from n/a through 2.4.4. In this architectural context, user-supplied data that is intended for display in a web browser is not adequately sanitized or encoded before being processed by the server-side application logic. This failure allows an attacker to inject malicious client-side scripts into legitimate web pages viewed by other users. Unlike reflected XSS where payload execution depends on immediate interaction with a crafted link, stored XSS persists within the target system's database or storage mechanism, ensuring that every user who accesses the compromised page will execute the injected code without any additional manipulation required from the attacker beyond the initial injection point.
The technical flaw resides in how the application handles input data submitted through its menu ordering and table reservation interfaces. When a user submits information such as an order note, comment, or profile detail containing malicious script tags or event handlers, the system fails to validate this content against a strict allowlist of safe characters or properly encode special HTML entities like less-than and greater-than signs before storing them in the backend database. Consequently, when another user, potentially including administrative staff or customers viewing their order history or public menu details, loads the affected page, the browser interprets the stored malicious script as legitimate code belonging to the site's domain. This bypasses same-origin policy protections because the scripts are served from the trusted origin of the Gloriafood application itself, granting them full access to cookies, session tokens, and local storage associated with that domain.
The operational impact of this vulnerability is severe due to its persistent nature and potential for widespread exposure. An attacker can exploit this flaw to steal sensitive user credentials by exfiltrating authentication cookies or session identifiers to a remote server under their control. This facilitates account takeover attacks where the adversary gains unauthorized access to customer accounts, potentially leading to financial fraud through saved payment methods or personal data theft including names, addresses, and contact information. Furthermore, if administrative interfaces are accessible via pages that reflect stored user input, an attacker could escalate privileges by stealing admin session tokens, thereby gaining complete control over the restaurant's ordering system, menu configurations, and reservation database. The vulnerability also enables phishing campaigns where attackers can inject fake login forms or deceptive content into legitimate pages to trick users into revealing further credentials, significantly damaging the reputation of the business and eroding customer trust in the platform's security posture.
From a classification perspective, this issue aligns with CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') as defined by the Common Weakness Enumeration standard. The specific behavior maps to ATT&CK technique T1059.007: JavaScript under Command and Control or Execution, where attackers use browser-based scripting languages to execute malicious actions within a victim's session. Additionally, it relates to CWE-643: Improper Mitigation of DOM-Based Vulnerabilities if the exploitation relies heavily on client-side processing of untrusted data. The persistence of the payload in the database also touches upon aspects of CWE-830: Inclusion of Functionality from Uncontrolled Control Source when considering how external inputs influence application behavior without proper validation.
Mitigating this vulnerability requires a multi-layered defense strategy focusing primarily on output encoding and input validation at both the client and server levels. Developers must implement strict context-aware output encoding, ensuring that all user-supplied data rendered in HTML is encoded appropriately to prevent browser interpretation as executable code. This involves converting special characters such as ampersands, quotes, angle brackets, and slashes into their corresponding HTML entities before insertion into the DOM or database storage where applicable for display purposes. Input validation should be enforced using a strict allowlist approach that rejects any input containing script tags, event handlers like onerror or onload, javascript: URIs, or other potentially dangerous syntax patterns commonly associated with XSS payloads.
Beyond code-level fixes, organizations should deploy Web Application Firewalls configured to detect and block common XSS signatures in HTTP requests targeting the affected endpoints. Implementing Content Security Policy headers can further mitigate damage by restricting the sources from which scripts are allowed to load, thereby preventing execution of injected inline scripts even if they bypass input filters. Regular security testing including dynamic application security scanning and manual penetration tests focused on stored injection vectors is essential to verify that remediation efforts have effectively closed these gaps in the Gloriafood software stack before deployment or during ongoing maintenance cycles for affected versions up to 2.4.4.