CVE-2026-96669Published
Food Store <= 1.5.5 - Unauthenticated Stored Cross-Site Scripting via 'service_type' Cookie
Exact source revision recorded 29 Oct 2026 12:12:12 UTC. It does not establish the source's current position. Latest evidence.
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-96669 · Microsoft / collected KEV context
cve-program · CVE-2026-96669
- https://www.wordfence.com/threat-intel/vulnerabilities/id/60725f12-6219-4c5e-8b5c-e925f0837ddb?source=cve
- https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L521
- https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L397
- https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L398
- https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/wfs-core-functions.php#L795
- https://plugins.trac.wordpress.org/browser/food-store/tags/1.5.5/includes/class-wfs-services.php#L150
Current operational correlations are not mixed into this historical source record. Open latest evidence to discover current connections.