The Responsive Food and Drink Menu plugin for WordPress contains a stored cross‑site scripting weakness in its display_pdf_menus shortcode. Because the plugin fails to properly sanitize and escape user‑supplied attributes, any authenticated contributor or higher user can inject malicious JavaScript. When a page containing the shortcode is loaded, the injected scripts run in the context of the visiting user, and, based on the nature of XSS, could potentially allow account hijacking, defacement or other client‑side attacks (inferred). The nature of the flaw matches CWE‑79.

The vulnerability affects all releases of the plugin through version 2.3, distributed by the vendor corporatezen222. Any WordPress site that has installed this plugin and has contributor‑level or higher users remains exposed until upgraded beyond 2.3.

With a CVSS score of 6.4 the flaw is considered moderate in severity, and an EPSS score of less than 1% indicates that exploitation is currently unlikely. The flaw is not listed in CISA's KEV catalog. Exploitation requires authenticated access; an attacker who can edit or add shortcodes with contributor privileges can inject scripts. Users who routinely view pages that use the shortcode are the target audience for the malicious payload, and the impact is primarily on confidentiality and integrity of client sessions.