The vulnerability exists in the WP Restaurant Listings plugin when the align parameter of the restaurant_summary shortcode is used. Because the input is not properly sanitized or escaped, a malicious payload can be stored in the database and executed in any user’s browser when the page is viewed, constituting a CWE‑79 Stored Cross‑Site Scripting flaw. The attacker can execute arbitrary JavaScript, compromising confidentiality by stealing credentials or session cookies, integrity by injecting malicious content, and possibly availability by delivering further attacks.

This flaw affects the WP Restaurant Listings plugin from any version up to and including 1.0.2, as distributed by wpdrift for WordPress sites.

The CVSS score of 6.4 indicates moderate severity, and the EPSS score of less than 1% suggests a low probability of widespread exploitation at this time. The flaw is not listed in the CISA KEV catalogue. The likely attack vector is an authenticated user with contributor level or higher privileges, who can submit or edit content that triggers the vulnerable shortcode. The stored payload will then run automatically for any user who views the affected page, making mitigation a priority for sites that rely on the plugin.