The Snillrik Restaurant Menu plugin for WordPress is vulnerable to stored cross‑site scripting due to insufficient input sanitization of the 'menu_style' shortcode attribute. An authenticated user with Contributor or higher privileges can inject arbitrary JavaScript, which is then stored in the database and executed whenever a page containing that shortcode is viewed. The script can steal user credentials, hijack sessions, or deface the site, thereby compromising confidentiality and integrity of the affected web application.

The vulnerability affects the Snillrik Restaurant Menu plugin, maintained by mattiaspkallio, in all releases up to and including version 2.3.0. Any WordPress site that has installed these versions is at risk if it permits authenticated contributors or higher roles to add or edit shortcode attributes.

The CVSS v3.1 score of 6.4 indicates a medium severity, while the EPSS of less than 1% implies a relatively low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Attackers must have at least Contributor access, so unauthenticated users cannot exploit it. Once the malicious script is injected, it executes for every visitor to pages containing the shortcode, allowing attackers to execute phishing, credential theft, or site defacement attacks. The risk is mitigated by applying the vendor patch or removing the plugin, and by enforcing strict role permissions.