CVE-2026-42709

Executive Summary

CVE-2026-42709 is an unauthenticated Cross-Site Scripting (XSS) vulnerability in the WordPress plugin "Food Menu – Restaurant Menu & Online Ordering for WooCommerce," affecting versions 6.0.5 and earlier. The flaw allows a remote, unauthenticated attacker to inject arbitrary script into a victim's browser session by crafting a malicious request, with impact scoped to confidentiality, integrity, and availability at low severity each but with a changed scope (S:C). At the time of writing, no patch has been identified and no public proof-of-concept or exploit code is available.

Technical Analysis

CVE-2026-42709 is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation, commonly referred to as Cross-Site Scripting). The vulnerability is described as "Unauthenticated Cross Site Scripting (XSS)" in the Food Menu plugin for WooCommerce, affecting versions up to and including 6.0.5.

The CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L indicates the following characteristics: the attack is network-accessible (AV:N), requires no privileges (PR:N), has low attack complexity (AC:L), and requires user interaction (UI:R) — meaning a victim must take some action such as visiting a crafted URL or interacting with a page element. The scope is changed (S:C), which means a successful exploit can affect resources beyond the vulnerable component's security authority, a typical characteristic of XSS that executes in the context of the broader web application and its users. Impact to confidentiality, integrity, and availability is low (C:L/I:L/A:L), consistent with a script-injection flaw that may allow session theft, defacement, or redirection rather than full system compromise.

XSS arises when user-supplied input is reflected into a web page without adequate output encoding or sanitization. In this plugin's context, an unauthenticated request parameter is rendered back to the browser inside HTML context, allowing an attacker to supply markup containing a <script> tag or event handler that the browser executes. The NVD description does not specify the exact parameter, endpoint, or rendering path involved, and no code-level detail is available; therefore the specific input vector remains undetermined from available data. The vulnerability class is a reflected or stored XSS in the plugin's front-facing functionality. Because the plugin handles restaurant menu display and online ordering, affected functionality likely includes menu rendering or order-related pages accessible to unauthenticated visitors, though no specific function or file name is disclosed in the source data.

The unauthenticated nature is significant: an attacker needs no account or session on the target site. The changed scope means script execution can reach beyond the plugin's own boundary into the hosting WordPress site's domain context, enabling attacks against authenticated users (including administrators) viewing the injected page.

Exploitation Scenarios

No public proof-of-concept or exploit code is available for CVE-2026-42709. The following attack chain is inferred strictly from the vulnerability class (unauthenticated XSS) and the CVSS vector. No specific function names, parameters, endpoints, or file paths are known from the provided data, so the sequence below is described at the vulnerability-class level.

1. Reconnaissance / target identification. An attacker identifies WordPress sites running the Food Menu – Restaurant Menu & Online Ordering for WooCommerce plugin at version 6.0.5 or earlier. This can be done by fingerprinting plugin assets served on front-end pages (for example, detecting plugin-specific script/CSS paths or WooCommerce menu markup) or through internet-wide scanning of sites with WooCommerce and restaurant-menu themes. No active exploitation requires prior authentication, so any reachable site with the plugin in the affected range is a candidate.

2. Triggering the flaw class. The attacker crafts a URL or request containing a script payload in the input that the plugin reflects into a rendered page. Because the flaw is unauthenticated, no login is required to reach the vulnerable handling path. The exact injection point is not disclosed in available data; at the class level, the attacker places malicious JavaScript in a request parameter that the plugin outputs into HTML without proper encoding.

3. Payload / execution method. The victim must load the crafted page or click a link (UI:R per the vector), at which point the injected script executes in the origin of the affected WordPress site. A typical payload would be a script that exfiltrates session cookies, performs actions as the victim, or redirects to an attacker-controlled page. Because the parameter names and endpoint are not published, the specific payload construction cannot be described without fabrication.

4. Post-exploitation impact. Successful execution occurs in the context of the victim's browser session on the target site. If the victim is an authenticated administrator, the attacker could leverage the script to perform privileged actions within that session, potentially leading to site takeover depending on WordPress capabilities and any missing protections. For unauthenticated visitors, impact is limited to their own session — possible credential/session theft, malicious redirection, or content manipulation. The CVSS changed scope (S:C) reflects the potential to affect resources beyond the plugin itself (the hosting site and its user sessions). The low CIA ratings reflect that this is a client-side injection, not direct server compromise.

Impact Assessment

The vulnerability affects WordPress sites running the Food Menu plugin for WooCommerce at version 6.0.5 or earlier. The blast radius is site-wide from a user-session perspective: although the injection point resides in the plugin, script execution occurs in the origin of the whole WordPress installation (changed scope). Consequences include theft of session tokens or cookies, unauthorized actions carried out as a logged-in victim, phishing or redirection of visitors, and defacement of affected pages.

Mapping to the CVSS subscores: AV:N means the attack can be launched remotely over the network; PR:N means no account is needed; AC:L means no special conditions are required; UI:R means a user must interact (visit a crafted link/page); S:C means impacts extend beyond the vulnerable component; and C:L/I:L/A:L indicate limited confidentiality, integrity, and availability impact. There is no server-side code execution implied by the data, so full host compromise is not a direct outcome — however, administrator-targeted XSS can escalate to site compromise through privileged in-session actions. No CISA KEV listing, no public exploit, and no EPSS score (not yet scored by FIRST.org) are available; exploitation likelihood cannot be quantified from the supplied data.

Detection Guidance

Sigma Rule

title: Potential XSS Exploitation Attempt Against Food Menu Plugin (CVE-2026-42709)
id: 8b6f1a42-3c7d-4e19-9a55-2f0c9d1e7a10
status: experimental
description: Detects script-tag or event-handler payloads in HTTP requests targeting the Food Menu WooCommerce plugin front-end, consistent with unauthenticated XSS exploitation attempts.
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-42709
author: Threat Intelligence
date: 2026/01/01
tags:
  - attack.t1059.007
  - attack.initial_access
logsource:
  category: webserver
detection:
  selection_method:
    cs-method:
      - GET
      - POST
  selection_payload:
    - cs-uri-query|contains:
        - '<script'
        - '%3Cscript'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    - cs-uri-query|contains:
        - 'document.cookie'
        - 'alert('
        - 'String.fromCharCode'
  condition: selection_method and selection_payload
falsepositives:
  - Legitimate rich-text submissions containing markup
  - Security scanners and fuzzers
level: medium

YARA Rule

rule CVE_2026_42709_XSS_Payload
{
    meta:
        description = "Detects common XSS payload indicators in HTTP request artifacts targeting Food Menu plugin (CVE-2026-42709)"
        author = "Threat Intelligence"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2026-42709"
        date = "2026-01-01"
        severity = "medium"

    strings:
        $s1 = "<script" nocase ascii wide
        $s2 = "onerror=" nocase ascii
        $s3 = "onload=" nocase ascii
        $s4 = "javascript:" nocase ascii
        $s5 = "document.cookie" nocase ascii
        $s6 = "String.fromCharCode" nocase ascii
        $plugin1 = "food-menu" nocase ascii
        $plugin2 = "restaurant-menu" nocase ascii
        $plugin3 = "woocommerce" nocase ascii

    condition:
        uint16(0) == 0x4854 or
        (2 of ($s*) and 1 of ($plugin*))
}

Suricata IDS Rule

alert http any any -> any any (msg:"CVE-2026-42709 Food Menu WooCommerce Unauthenticated XSS Attempt"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"<script"; nocase; http.uri; content:"food-menu"; nocase; sid:202642709; rev:1; reference:cve,2026-42709; classtype:web-application-attack;)
alert http any any -> any any (msg:"CVE-2026-42709 Food Menu WooCommerce XSS Event Handler Payload"; flow:established,to_server; http.uri; content:"onerror="; nocase; http.uri; content:"restaurant-menu"; nocase; sid:202642710; rev:1; reference:cve,2026-42709; classtype:web-application-attack;)

Elastic Detection

sequence by source.ip with maxspan=30s
  [network where network.protocol == "http" and
    url.query : ("*<script*", "*%3Cscript*", "*onerror=*", "*onload=*", "*javascript:*")]
  [network where network.protocol == "http" and
    url.path : ("*food-menu*", "*restaurant-menu*", "*woocommerce*")]

Splunk SPL Query

index=web sourcetype=access_combined
| where match(lower(uri_query), "(<script|%3cscript|onerror=|onload=|javascript:|document\.cookie)")
| where match(lower(uri), "(food-menu|restaurant-menu|woocommerce)")
| stats count min(_time) as first_seen max(_time) as last_seen values(uri) as targeted_uris by src_ip, host
| where count > 0
| sort - count

Wazuh OSSEC Rule

<group name="web,appsec,cve-2026-42709,">
  <rule id="2026427" level="10">
    <decoded_as>web-accesslog</decoded_as>
    <url>food-menu|restaurant-menu|woocommerce</url>
    <regex type="pcre2">(?i)(%3Cscript|<script|onerror=|onload=|javascript:)</regex>
    <description>CVE-2026-42709: Possible XSS exploitation attempt against Food Menu WooCommerce plugin</description>
    <mitre>
      <id>T1059.007</id>
    </mitre>
  </rule>
</group>

Mitigation & Patch Guidance

Patch confidence: 0/4 — UNPATCHED. No patch evidence from any tracked source, no vendor fix, and no workaround has been identified.

1. Immediate mitigations.

   • Deploy a Web Application Firewall (WAF) with virtual patching that blocks script-tag and event-handler payloads in query strings and request bodies directed at plugin assets and front-end pages.
   • Restrict or review deployment of the plugin if online ordering or menu rendering is not actively required; consider disabling the affected plugin until a fix is available.
   • Ensure WordPress and WooCommerce core are fully updated and that any generic XSS protections (security plugins, content security policy) are active.
   • Enforce a Content-Security-Policy (CSP) that disallows inline and untrusted script execution to reduce the impact of successful injection.
   • Set HttpOnly and Secure flags on session cookies to reduce the value of session theft via XSS.
   • Monitor access logs for payloads containing <script, onerror=, onload=, or javascript: within requests to plugin-related paths.

2. Patch / upgrade steps.

   • No patched version is available at this time. Track the plugin vendor's release channel for a version above 6.0.5 that addresses CVE-2026-42709.
   • Once a fixed version is published, upgrade immediately and verify the deployed version is outside the affected range.
   • Validate the fix by confirming the previously reachable injection path no longer reflects unencoded input.

3. Long-term hardening.

   • Establish a routine for monitoring plugin advisories and applying updates promptly.
   • Maintain an inventory of installed WordPress plugins and their versions to reduce exposure windows.
   • Adopt secure coding review for any custom integrations and enforce output encoding for all user-supplied data.
   • Consider least-privilege WordPress roles to limit the blast radius if an administrative session is compromised via XSS.

References

• NVD — CVE-2026-42709: https://nvd.nist.gov/vuln/detail/CVE-2026-42709
• CWE-79 — Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'): https://cwe.mitre.org/data/definitions/79.html
• WordPress Plugin Security guidance: https://wordpress.org/plugins/
• OWASP Cross Site Scripting Prevention Cheat Sheet: https://cheatsheetseries.owasp.org/cheatsheets/Cross_Site_Scripting_Prevention_Cheat_Sheet.html

No public proof-of-concept, exploit code, or Nuclei template is available. No CISA KEV listing exists for this CVE. No EPSS score has been assigned by FIRST.org. No threat actor campaigns or in-the-wild exploitation evidence are currently associated with CVE-2026-42709 based on available data.