The UpMenu plugin is vulnerable to stored cross‑site scripting through the lang attribute of the upmenu‑menu shortcode. Insufficient sanitization allows an authenticated contributor‑level user to embed arbitrary JavaScript that is persisted in the site’s content. When a visitor loads a page containing the malicious shortcode, the injected script executes in the visitor’s browser, enabling attacks such as cookie theft, session hijacking or defacement.

The affected product is the UpMenu – Online ordering for restaurants WordPress plugin. Versions up to 3.1, inclusive, are vulnerable. WordPress sites that include this plugin and grant contributor or higher roles to users expose themselves to exploitation.

The vulnerability scores a CVSS 6.4 indicating moderate severity and an EPSS of less than 1% showing very low exploitation probability. It is not listed in the CISA KEV catalog. Attack requires an authenticated user with contributor or higher access who can edit content. The attacker must insert a malicious value into the lang attribute of the shortcode; once stored, any user who views the affected page will have the attacker’s script executed in their browser.