The Food Store plugin contains an Improper Neutralization of Input during Web Page Generation flaw, known as Cross‑Site Scripting. This allows an attacker to inject arbitrary JavaScript into the browser of any visitor who follows a crafted link. Once the script runs, the attacker could steal the user's authentication cookies, perform actions on behalf of that user, or display malicious content. The weakness is formally classified as CWE‑79 and can compromise the confidentiality, integrity, and availability of user sessions.

The vulnerability affects the WordPress plugin WP Scripts Food Store – Online Food Delivery & Pickup for all supported versions up to and including 1.5.4. The plugin is distributed by WP Scripts and commonly used on WordPress sites that provide online food ordering.

The CVSS base score of 7.1 classifies the flaw as moderate to high severity, and the EPSS score of less than 1% indicates a low probability of exploitation at any given time. The plugin has not been listed in the CISA KEV catalog, suggesting that no confirmed widespread exploitation incidents are public. The likely attack vector is a crafted URL that a victim follows, prompting the rendered page to execute injected JavaScript. No additional prerequisites are needed beyond the ability to convince a user to click a link.