The vulnerability is a Stored XSS flaw due to improper neutralization of user‑supplied input during page generation. An attacker who can insert content that the application saves will have that malicious script executed whenever a page displays the data, allowing the attacker to steal session cookies, deface content, or redirect visitors. The impact is therefore client‑side code execution that can compromise confidentiality, integrity, and potentially disrupt user experience.

The flaw exists in Gloriafood’s Restaurant Menu – Food Ordering System – Table Reservation plugin. Versions from the initial release through 2.4.4 are affected; any installation running 2.4.4 or earlier is vulnerable.

The CVSS score of 6.5 marks it as a high‑severity risk. With no EPSS score available and the vulnerability not listed in CISA KEV, the actual exploitation probability is unknown, but stored XSS is a common attack vector and can be exploited through the plugin’s data entry interfaces. The attack likely requires an authenticated user with permission to add or edit menu items or reservation data, after which the stored script runs in the context of any visitor who views the affected page.