CVE-2026-114700 Gloriafood CVE debrief

Who should care

Administrators and users of the WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin, especially those using versions up to 2.4.4, should assess their exposure and consider updating the plugin to mitigate the vulnerability.

Why it matters

CVE-2026-114700 is a Stored XSS vulnerability in the WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin versions up to 2.4.4. Defenders should verify and update the plugin, implement input validation and output encoding, and monitor for suspicious activity to prevent potential security breaches.

• Defenders need to verify and update the plugin to prevent potential XSS attacks.
• Successful exploitation could allow attackers to inject malicious scripts, potentially leading to unauthorized actions or data manipulation.
• Defenders should monitor for suspicious activity related to the plugin to detect potential attacks.
• Updating the plugin is crucial to prevent potential security breaches.

Technical summary

The WordPress Restaurant Menu – Food Ordering System – Table Reservation plugin versions up to 2.4.4 contain a Stored Cross Site Scripting (XSS) vulnerability. This vulnerability allows attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data manipulation. The vulnerability is a result of improper neutralization of input during web page generation, allowing attackers to store malicious scripts that can be executed on web pages. Defenders should prioritize verifying and updating the plugin to a version beyond 2.4.4 if currently using an affected version.

Defensive priority

Defenders should prioritize verifying and updating the plugin to a version beyond 2.4.4 if currently using an affected version.

Recommended defensive actions

• Verify the version of the Restaurant Menu – Food Ordering System – Table Reservation plugin and update to a version beyond 2.4.4 if necessary.
• Implement input validation and output encoding to prevent XSS attacks.
• Monitor for any suspicious activity related to the plugin.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.
• Track exceptions, retest remediated assets, and close the item only after evidence is documented.
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.

Evidence notes

The CVE record and source item provide details on the vulnerability, including its existence in plugin versions up to 2.4.4 and its classification as a Stored XSS vulnerability. The source item provides additional context on the vulnerability, but details are limited. Defenders should verify the plugin version and review the official advisory for specific guidance on affected scope and severity. The CVE Program record and NIST NVD detail page offer additional information on the vulnerability and its potential impact.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.