CVE-2026-96568 is a stored cross-site scripting vulnerability (CWE-79) in the jetmonsters Restaurant Menu and Food Ordering WordPress plugin. The issue arises from insufficient input sanitization and output escaping of the 'phone_number' parameter, enabling attackers to inject arbitrary web scripts. This vulnerability affects all plugin versions from 0 through 2.4.14 inclusive. The CVSS v3.1 base score is 7.2, indicating a high severity with network attack vector, low attack complexity, no privileges or user interaction required, and impacts on confidentiality and integrity with scope changed.

An unauthenticated attacker can exploit this vulnerability to inject malicious scripts into pages viewed by users, potentially leading to theft of sensitive information, session hijacking, or other malicious actions executed in the context of the victim's browser. The vulnerability impacts confidentiality and integrity but does not affect availability.

No official patch or fix is currently referenced. Users should monitor the vendor's advisories for updates. Until a fix is available, consider disabling or restricting use of the affected plugin, or applying web application firewall (WAF) rules to block malicious payloads targeting the 'phone_number' parameter. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.