CVE-2026-42709: WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability

Q: What level of access does an attacker need to exploit this issue?

The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation does require user interaction, as reflected by the UI:R vector.

Q: Which installations are known to be affected?

Installations using the Food Menu – Restaurant Menu & Online Ordering for WooCommerce WordPress plugin version 6.0.5 or earlier are affected according to the available information.

Published Oct 10, 2026

Updated

Unauthenticated Cross Site Scripting (XSS) in Food Menu – Restaurant Menu & Online Ordering for WooCommerce <= 6.0.5 versions.

Affected Software

1 affected component

WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce<=6.0.5

Event History

Oct 10, 2026

CVE Published

via MITRE·07:35 PM

Data Sourced

via MITRE·07:35 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·08:16 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

The vulnerability is described as unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation does require user interaction, as reflected by the UI:R vector.

Which installations are known to be affected?

Installations using the Food Menu – Restaurant Menu & Online Ordering for WooCommerce WordPress plugin version 6.0.5 or earlier are affected according to the available information.

CVE-2026-42709: WordPress Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin <= 6.0.5 - Cross Site Scripting (XSS) vulnerability

Affected Software

Event History

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which installations are known to be affected?

Company

Resources

Contact

Frequently Asked Questions

What level of access does an attacker need to exploit this issue?

Which installations are known to be affected?