Threats tagged 'ghsa-cx7q-6956-p3vx'

The Food Store plugin for WordPress versions up to and including 1.5.5 contains a stored cross-site scripting (XSS) vulnerability via the 'service_type' cookie. An unauthenticated attacker can inject malicious scripts by supplying a payload through the ?type= query parameter on the public checkout page. This payload is stored in the cookie, persisted to order metadata, and rendered unescaped in the admin panel, leading to script execution when accessed.