CVE-2026-116622

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site to have the 'Enable Checkout Service Fields' option turned off, which is a non-default configuration, while 'Enable Pickup/Delivery Service' remains enabled.

• CWE-79

• https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-order.php#L302
• https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L405
• https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L406
• https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L523
• https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L580
• https://www.wordfence.com/threat-intel/vulnerabilities/id/d1f3a9e4-9bdf-4342-a735-72e70219daeb?source=cve

Published

Oct 30, 2026

Last Modified

Oct 30, 2026

Status

Received

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11661Use after free in Views in Google Chrome on Windows prior to…8.3
• CVE-2026-116610The Clean Login plugin for WordPress is vulnerable to Missin…4.3
• CVE-2026-116612A flaw was found in GStreamer Editing Services (gst-editing-…7.8
• CVE-2026-116613The Animated Text Block plugin for WordPress is vulnerable t…7.5
• CVE-2026-11662Type Confusion in Bindings in Google Chrome prior to 149.0.7…8.8
• CVE-2026-116620A security vulnerability has been detected in Tencent RapidJ…7.3
• CVE-2026-116623A vulnerability was detected in code-projects Simple Content…7.3
• CVE-2026-116627Improper neutralization of input during web page generation …
• CVE-2026-11663Use after free in Skia in Google Chrome prior to 149.0.7827.…8.3
• CVE-2026-116631A malicious web page could open a tel link in a window that …5.4
• CVE-2026-116632A malicious web page could insert arbitrary text into the Fa…5.4
• CVE-2026-116634OmniRoute 3.8.50 before 3.8.52 contains a missing authentica…5.9