CVE-2026-96568 in Restaurant Menu and Food Ordering Plugin
Summary
by MITRE • 09/25/2026
The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/25/2026
The vulnerability identified within the Restaurant Menu and Food Ordering plugin for WordPress, affecting all versions up to and including 2.4.14, represents a critical security flaw rooted in insufficient input sanitization and output escaping mechanisms. This specific weakness is located within the phone_number parameter, which serves as an entry point for malicious actors to inject arbitrary web scripts into the application's database. The core technical failure lies in the plugin's handling of user-supplied data; rather than validating or encoding the content before storage, the system accepts raw input and subsequently renders it directly into HTML contexts without proper sanitization. This architectural oversight allows an attacker to embed executable JavaScript code within what appears to be a standard phone number field, effectively bypassing basic security controls that rely on simple string matching or format validation.
From a classification perspective, this vulnerability aligns with CWE-79, commonly known as Improper Neutralization of Input During Web Page Generation, which is the underlying cause for Stored Cross-Site Scripting attacks. The operational impact of such an exploit is severe because it enables unauthenticated attackers to persist malicious payloads on the server side. Unlike reflected XSS where the payload exists only in a single request, stored XSS ensures that every user who views the affected page or interacts with the compromised data will trigger the execution of the injected script. This persistence transforms the vulnerability into a widespread threat vector capable of compromising multiple users without requiring further interaction from the attacker after the initial injection.
The consequences of successful exploitation extend beyond mere defacement, as attackers can leverage this capability to perform session hijacking by stealing administrator or user cookies, thereby gaining unauthorized access to sensitive accounts. Furthermore, the injected scripts can be used to redirect victims to phishing sites designed to harvest credentials, manipulate page content to display fraudulent information, or even initiate drive-by downloads if combined with other exploits. In the context of a restaurant ordering system, this could also lead to significant reputational damage and loss of customer trust, as patrons may encounter malicious redirects or compromised forms while attempting to place orders or contact support.
To mitigate this risk, immediate action is required by updating the plugin to version 2.4.15 or later, where these sanitization issues have been addressed. In environments where an update cannot be applied immediately, administrators should implement strict input validation on the server side to ensure that only valid phone number formats are accepted and consider implementing Content Security Policy headers to restrict script execution sources as a defensive layering measure. Additionally, regular security audits focusing on output encoding practices for all user-controlled data points can prevent similar vulnerabilities from arising in other parts of the application ecosystem. This incident underscores the importance of adhering to secure coding standards that mandate rigorous validation and escaping at every stage of data processing within web applications.