CVE-2026-96669

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'service_type' Cookie in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The attack is seeded unauthenticated by supplying a payload via the ?type= query parameter on the public checkout page, which the plugin writes directly into the browser's service_type cookie; this cookie value is later persisted to order meta and rendered unescaped in the admin panel.

• CWE-79

• https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L150
• https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L397
• https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L398
• https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L521
• https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/wfs-core-functions.php#L795
• https://www.wordfence.com/threat-intel/vulnerabilities/id/60725f12-6219-4c5e-8b5c-e925f0837ddb?source=cve

Published

Oct 29, 2026

Last Modified

Oct 29, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-96659A flaw was found in Foreman. This vulnerability allows an au…9.1
• CVE-2026-96660The User Registration & Membership – Free & Paid Memberships…7.2
• CVE-2026-96661The Gmedia Photo Gallery plugin for WordPress is vulnerable …7.5
• CVE-2026-96662The Appointment Booking Plugin – LatePoint | Calendar & Sche…7.5
• CVE-2026-96666The Schema App Structured Data plugin for WordPress is vulne…7.2
• CVE-2026-96667The Real Estate Manager – Property Listing and Agent Managem…7.2
• CVE-2026-9667IBM WebSphere Application Server 9.0, and 8.5 is vulnerable …5.3
• CVE-2026-96671Cross-Site Request Forgery (CSRF) vulnerability in fifu.app …8.8
• CVE-2026-96672Frappe ERPNext versions before 16.34.1 fail to validate that…6.4
• CVE-2026-96673Photoview through 2.4.0 contains an SQL injection vulnerabil…7.5
• CVE-2026-96674alsa-lib through 1.2.16.1 computes combined topology element…4.4
• CVE-2026-96675alsa-lib through 1.2.16.1 contains a denial of service vulne…3.3