The vulnerable element is the "phone_number" field used when placing orders. Insufficient filtering allows an attacker to store malicious JavaScript. When a user later visits a page containing that order, the injected script runs with the browser's privileges, leading to cookie theft, session hijacking, or defacement. The weakness aligns with CWE‑79, a classic reflected or stored XSS scenario.

The flaw exists in the WordPress plugin "Restaurant Menu and Food Ordering" by Jet Monsters, versions up to and including 2.4.14. Sites running any of these versions and using the plugin’s order or purchase forms are susceptible.

The vulnerability carries a CVSS score of 7.2, indicating high severity. Because it is unauthenticated and stored, any visitor to a compromised page may trigger exploitation. No EPSS value is provided, but the lack of observed exploitation coupled with the high CVSS suggests moderate to high likelihood for opportunistic use. The vulnerability is not listed in CISA’s KEV catalog, indicating no confirmed large‑scale exploitation reports at this time. Attackers would need to inject the payload via the public order interface; once stored, the script executes for all users who view the affected page.