CVE-2026-96568 jetmonsters CVE debrief

Who should care

Defenders responsible for WordPress installations with the Restaurant Menu and Food Ordering plugin should assess exposure and prioritize verification and potential updates. This includes reviewing and adjusting input sanitization and output escaping for the 'phone_number' parameter to prevent similar vulnerabilities. Additionally, defenders should monitor for potential exploitation attempts to detect possible attacks. Security teams and vulnerability are

Why it matters

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting, allowing unauthenticated attackers to inject arbitrary web scripts. Defenders should prioritize verification, updates, and monitoring to prevent potential exploitation.

• Defenders must verify and update the plugin to prevent potential exploitation
• Defenders should monitor for potential exploitation attempts to detect possible attacks
• Defenders need to review and adjust input sanitization and output escaping for the 'phone_number' parameter to prevent similar vulnerabilities

Technical summary

The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter in all versions up to, and including, 2.4.14 due to insufficient input sanitization and output escaping. This vulnerability allows unauthenticated attackers to inject arbitrary web scripts, potentially leading to malicious code execution on affected sites. The vulnerability's technical impact is significant as it can compromise the security of WordPress installations with the plugin. The CVE record and NVD entry provide additional details on the vulnerability, including its description and CVSS score.

Defensive priority

Defenders should prioritize verifying and updating the plugin to a fixed version, if available, and monitor for potential exploitation attempts.

Recommended defensive actions

• Verify and update the Restaurant Menu and Food Ordering plugin to a fixed version, if available
• Monitor for potential exploitation attempts
• Review and adjust input sanitization and output escaping for the 'phone_number' parameter
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up
• Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed
• Check relevant monitoring, detection, and logs for exposed assets that need extra review

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description and CVSS score of 7.2. The vulnerability is classified as HIGH severity. The Restaurant Menu and Food Ordering plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'phone_number' parameter. The CVE record was published on 2026-09-25T08:16:42.567Z and has not been modified since then. The official CVE Program record and NVD detail page offer source-provided CVE metadata and vulnerability assessment. Additional source might

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.