The UpMenu WordPress plugin for restaurant online ordering suffers from a stored XSS vulnerability in all versions up to 3.1. This vulnerability is triggered through the 'lang' attribute of the 'upmenu-menu' shortcode, where user input is not properly sanitized or escaped before being rendered in web pages. Authenticated attackers with contributor or higher privileges can exploit this to inject arbitrary JavaScript, which executes in the context of users visiting the compromised pages. This can lead to information disclosure or session hijacking. The vulnerability is tracked as CVE-2026-1910 with a CVSS 3.1 base score of 6.4 (medium severity).

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode attribute. These scripts execute in the browsers of users who view the infected pages, potentially leading to theft of sensitive information or session tokens. The vulnerability does not allow privilege escalation or denial of service directly but compromises user trust and data confidentiality.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the UpMenu plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.