{"id":"CVE-2026-116622","kind":"vulnerability","aliases":["CVE-2026-116622"],"related":[],"title":"WordPress Food Store plugin: unauthenticated stored script injection via service_time","description":"The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site to have the 'Enable Checkout Service Fields' option turned off, which is a non-default configuration, while 'Enable Pickup/Delivery Service' remains enabled.","summary":"The Food Store online food delivery and pickup plugin for WordPress does not sanitize the service_time parameter, so unauthenticated visitors can store malicious scripts. Those scripts run in the browser of any user who opens the injected page.","severity":"high","cvss":7.2,"epss":0.00241,"exploited":false,"exploited_at":null,"products":[{"name":"food-store","fixed":[],"affected":"<= 1.5.5","ecosystem":"wordpress"}],"ecosystems":["wordpress"],"tags":["food-store","package","stored-xss","woocommerce","wordpress","xss"],"not_affected_if":["checkout-service-fields-enabled","default-config","plugin-not-installed"],"how_to_check":"- Check whether the Food Store plugin is installed and its version is `1.5.5` or lower in the WordPress plugins screen.\n- Check whether the 'Enable Checkout Service Fields' option is turned off while 'Enable Pickup/Delivery Service' is on.","fix":"No patched version released; plugin closed on wordpress.org pending review. Deactivate and remove the plugin, or block the service_time cookie with a WAF until a fix ships.","status":"open","published_at":"2026-10-30T07:16:33+00:00","first_seen_at":"2026-10-30T07:29:00+00:00","triaged_at":"2026-10-30T07:30:08+00:00","updated_at":"2026-10-30T18:23:38+00:00","category":"package","confidence":0.8,"triage":{"at":"2026-10-30T07:30:08Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WordPress Food Store plugin: unauthenticated stored script injection via service_time","impact":"medium","summary":"The Food Store online food delivery and pickup plugin for WordPress does not sanitize the service_time parameter, so unauthenticated visitors can store malicious scripts. Those scripts run in the browser of any user who opens the injected page.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","woocommerce","food-store"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Attacker runs scripts in visitors' and admins' browsers on the site","analyst_note":"Confirm a patched plugin version beyond 1.5.5 and whether the vendor has released a fix; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116622.","how_to_check":"- Check whether the Food Store plugin is installed and its version is `1.5.5` or lower in the WordPress plugins screen.\n- Check whether the 'Enable Checkout Service Fields' option is turned off while 'Enable Pickup/Delivery Service' is on.","plain_action":"","needs_analyst":true,"not_affected_if":["default-config","plugin-not-installed","checkout-service-fields-enabled"],"who_is_affected":"Sites running the Food Store plugin version `1.5.5` or lower where the 'Enable Checkout Service Fields' option is turned off and 'Enable Pickup/Delivery Service' is enabled. Sites with the checkout service fields option enabled, or without this plugin, are not exposed.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00073,"input_tokens":4242,"output_tokens":612,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm a patched plugin version beyond 1.5.5 and whether the vendor has released a fix; check the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-116622.","search":"'-116622':14A,17A '-2026':13A,16A '1.5.5':100C 'access':129C 'arbitrari':118C 'attack':115C 'browser':61B 'checkout':141C 'configur':153C 'cross':85C 'cross-sit':84C 'cve':12A,15A 'default':152C 'deliveri':36B,75C 'due':101C 'enabl':140C,155C,159C 'escap':108C 'execut':125C 'exploit':133C 'field':143C 'food':2A,19A,22B,32B,35B,71C,74C 'food-stor':21B 'food-store':18A 'includ':99C 'inject':8A,68B,117C,131C 'input':104C 'insuffici':103C 'make':110C 'malici':54B 'non':151C 'non-default':150C 'onlin':34B,73C 'open':66B 'option':144C 'output':107C 'packag':24B 'page':69B,122C,132C 'paramet':48B,92C 'pickup':38B,76C 'pickup/delivery':156C 'plugin':4A,39B,77C 'possibl':112C 'remain':158C 'requir':134C 'run':58B 'sanit':44B,105C 'script':7A,55B,57B,87C,120C 'servic':10A,46B,90C,142C,157C 'site':86C,136C 'store':3A,6A,20A,23B,26B,33B,53B,72C,83C 'stored-xss':25B 'time':11A,47B,91C 'turn':145C 'unauthent':5A,50B,114C 'user':64B,128C 'version':95C 'via':9A,88C 'visitor':51B 'vulner':81C 'web':119C 'whenev':126C 'woocommerc':28B 'wordpress':1A,29B,41B,79C 'xss':27B,30B","nicknames":[],"mitigations":[],"who_affected":"Sites running the Food Store plugin version `1.5.5` or lower where the 'Enable Checkout Service Fields' option is turned off and 'Enable Pickup/Delivery Service' is enabled. Sites with the checkout service fields option enabled, or without this plugin, are not exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"first_public_at":"2026-10-30T07:16:33+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116622","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116622","severity":null,"published_at":"2026-10-30T07:16:33+00:00","modified_at":"2026-10-30T07:16:33+00:00","first_seen_at":"2026-10-30T07:29:00+00:00","fetched_at":"2026-10-30T07:29:00+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-116622:1135","url":null,"severity":null,"published_at":"2026-10-30T07:31:16+00:00","modified_at":"2026-10-30T07:31:16+00:00","first_seen_at":"2026-10-30T07:31:16+00:00","fetched_at":"2026-10-30T07:31:16+00:00","note":"No patched version: wordpress.org shows plugin closed Oct 23 2026 (temporary, pending review), latest 1.5.5; WP Vanguard (Wordfence data) says no patched version. Injection vector is the service_time cookie. Sibling CVE-2026-96669 (service_type cookie) same plugin, same range."},{"source":"epss","external_id":"CVE-2026-116622","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-116622","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-30T18:23:38+00:00","fetched_at":"2026-10-30T18:23:38+00:00","note":null}],"documents":[{"id":14256,"url":"https://wordpress.org/plugins/food-store/","title":"Food Store plugin page (closed Oct 23, 2026; latest 1.5.5)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":22076,"url":"https://wpvanguard.com/vulnerabilities/plugin/food-store","title":"WP Vanguard: Food Store <= 1.5.5 service_time cookie stored XSS, no patched version","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}