CVE-2026-96669

Name of the Vulnerable Software and Affected Versions The Food Store – Online Food Delivery & Pickup versions prior to 1.5.6

Description Insufficient input sanitization and output escaping allow unauthenticated attackers to perform Stored Cross-Site Scripting (XSS), a technique where malicious scripts are permanently stored on the target server. An attacker can seed the attack by providing a payload through the type query parameter on the public checkout page. The plugin writes this value into the service type cookie, which is subsequently persisted to order meta and rendered without escaping in the admin panel, leading to script execution when a user accesses the affected page.

Recommendations Update the plugin to version 1.5.6 or later.