The Zuppler Online Ordering plugin for WordPress is vulnerable to Cross‑Site Request Forgery due to missing or incorrect nonce validation on the options page. An unauthenticated attacker can forge a request that an authenticated administrator might submit, which updates plugin settings and injects malicious scripts that are then stored. The result is stored cross‑site scripting that affects every visitor to the site, jeopardizing confidentiality, integrity, and availability of the web application. This flaw is a classic example of the missing or ineffective access control found in CWE‑352.

The vulnerability affects the Zuppler Online Ordering WordPress plugin developed by bogdansilivestru, in all releases up to and including version 2.1.0. Users running any of these versions are potentially exposed.

The CVSS base score of 6.1 indicates a moderate severity level. The EPSS score is less than 1%, suggesting that exploitation is unlikely in the wild in the near term, and the vulnerability is not listed in the CISA KEV catalog. Attackers would need to provoke an administrator to click a crafted link while the victim is logged in with administrative privileges. Once the forged request succeeds, an attacker can inject arbitrary script that will run in the context of any user accessing the site, making this risk primarily a cross‑site scripting threat rather than a direct remote code execution scenario.