---
id: "CVE-2026-116622"
kind: "vulnerability"
aliases: ["CVE-2026-116622"]
title: "WordPress Food Store plugin: unauthenticated stored script injection via service_time"
severity: "high"
cvss: 7.2
epss: 0.00241
exploited: false
status: "open"
category: "package"
products: [{"name": "food-store", "fixed": [], "affected": "<= 1.5.5", "ecosystem": "wordpress"}]
ecosystems: ["wordpress"]
tags: ["food-store", "package", "stored-xss", "woocommerce", "wordpress", "xss"]
not_affected_if: ["checkout-service-fields-enabled", "default-config", "plugin-not-installed"]
published_at: "2026-10-30T07:16:33+00:00"
first_seen_at: "2026-10-30T07:29:00+00:00"
updated_at: "2026-10-30T18:23:38+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-116622", "first_seen_at": "2026-10-30T07:29:00+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-30T07:31:16+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-116622", "first_seen_at": "2026-10-30T18:23:38+00:00"}]
---

# WordPress Food Store plugin: unauthenticated stored script injection via service_time

The Food Store online food delivery and pickup plugin for WordPress does not sanitize the service_time parameter, so unauthenticated visitors can store malicious scripts. Those scripts run in the browser of any user who opens the injected page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- wordpress:food-store affected <= 1.5.5 fixed ?

## How to check

- Check whether the Food Store plugin is installed and its version is `1.5.5` or lower in the WordPress plugins screen.
- Check whether the 'Enable Checkout Service Fields' option is turned off while 'Enable Pickup/Delivery Service' is on.

## Fix

No patched version released; plugin closed on wordpress.org pending review. Deactivate and remove the plugin, or block the service_time cookie with a WAF until a fix ships.

## Timeline

- 2026-10-30T07:29:00+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-116622
- 2026-10-30T07:31:16+00:00 analyst — No patched version: wordpress.org shows plugin closed Oct 23 2026 (temporary, pending review), latest 1.5.5; WP Vanguard (Wordfence data) says no patched version. Injection vector is the service_time cookie. Sibling CVE-2026-96669 (service_type cookie) same plugin, same range.
- 2026-10-30T18:23:38+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-116622

## Documents

- [advisory] Food Store plugin page (closed Oct 23, 2026; latest 1.5.5) https://wordpress.org/plugins/food-store/
- [describes] WP Vanguard: Food Store <= 1.5.5 service_time cookie stored XSS, no patched version https://wpvanguard.com/vulnerabilities/plugin/food-store

## From the sources

The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. Exploitation requires the site to have the 'Enable Checkout Service Fields' option turned off, which is a non-default configuration, while 'Enable Pickup/Delivery Service' remains enabled.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_