wpscripts vulnerabilities and threats

The Food Store – Online Food Delivery & Pickup WordPress plugin up to version 1.5.5 is vulnerable to a stored cross-site scripting (XSS) flaw via the 'service_type' cookie. An unauthenticated attacker can inject malicious scripts by supplying a crafted payload through the public checkout page's ?type= query parameter. This payload is stored in the cookie, persisted in order metadata, and rendered without proper escaping in the admin panel, leading to script execution when accessed.