The vulnerability allows an attacker to store malicious script code in the VikRestaurants plugin input fields, which is later rendered unescaped when the plugin outputs the data to web pages. This stored XSS flaw means that a determined attacker could inject JavaScript that executes in the browsers of any user who views the affected content, potentially leading to session hijacking, defacement, or further propagation of malicious payloads. The weakness is captured as CWE‑79.

The issue affects the WordPress VikRestaurants plugin released by e4jvikwp. All versions from the earliest available release up to and including 1.5.1 are vulnerable. If your site is running the plugin at or below 1.5.1, it is affected.

The CVSS base score of 5.9 indicates a moderate severity, while the EPSS score of less than 1% suggests that exploitation is unlikely but not impossible. The vulnerability is not listed in the CISA KEV catalog. Because the flaw is stored, any user (including ordinary visitors) can be influenced by an attacker who can supply content to the plugin’s fields. The benefit to the attacker is the execution of arbitrary JavaScript in the victim’s browser context.