wpscripts vulnerabilities

Products

• Food Store – Online Food Delivery & Pickup 3

Latest wpscripts CVEs

Newest publication first

1. CVE-2026-116622 Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_time' Cookie

   Published 2026-10-30

   High·CVSS 7.2

   The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'service_time' parameter in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for una...

2. CVE-2026-96669 Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie

   Published 2026-10-29

   High·CVSS 7.2

   The Food Store – Online Food Delivery & Pickup plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'service_type' Cookie in all versions up to, and including, 1.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenti...

3. CVE-2022-4974 Freemius SDK <= 2.4.2 - Missing Authorization Checks

   Published 2024-10-16

   Medium·CVSS 6.3

   The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.