Security Alert Summary
The UpMenu – Online ordering for restaurants WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the lang attribute of the upmenu-menu shortcode. Authenticated users with contributor-level access or higher can inject scripts that will execute when an injected page is viewed, due to insufficient input sanitization and output escaping of user-supplied attributes.
CVE Details
- CVE ID: CVE-2026-1910
- Affected component: UpMenu – Online ordering for restaurants plugin for WordPress
- Affected versions: All versions up to and including 3.1 (as stated in the CVE entry)
- Published: February 14, 2026 at 7:16:11 AM UTC
- Last modified: February 14, 2026 at 7:16:11 AM UTC
- CVSS v3.1 Base Score: 6.4
- CVSS v3.1 Severity: MEDIUM
- CVSS v3.1 Vector:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User Interaction: Privileges Required: LOW (authenticated users such as contributors and above as noted in the description); User Interaction: NONE
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / Weakness: CWE-79 (Cross-site Scripting)
Technical Details
The vulnerability is a stored cross-site scripting (XSS) issue originating from insufficient input sanitization and insufficient output escaping of user-supplied attributes for the upmenu-menu shortcode. Specifically, the lang attribute can contain attacker-supplied content that is stored and later rendered into pages without proper escaping. When an authenticated attacker with contributor-level access or higher inserts a crafted upmenu-menu shortcode using a malicious lang value, that content can be stored and will execute as script in the context of any user who views the affected page.
The CVE entry attributes the root cause to missing or inadequate checks on user-supplied shortcode attributes (input sanitization and output escaping), which allows arbitrary web scripts to be persisted and executed in viewers’ browsers.
How This Could Impact Your Website
Consider a site with a site owner, an internal editor, and an external contractor who contributes content. If a contractor or contributor inserts a malicious upmenu-menu shortcode with a crafted lang attribute, that script could execute whenever an editor or site owner loads the page. Practical consequences aligned with the CVSS impacts include exposure of information visible on the page (for example, internal user email addresses or other data rendered on the page) and an increased risk of targeted phishing or social engineering against staff and administrators. The vulnerability does not indicate an availability impact, and the documented confidentiality and integrity impacts are limited in scope.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review your setup.
Recommended Actions
- Update the affected plugin as soon as a patched version is available. (The CVE entry does not specify a fixed version.)
- Review and reduce unnecessary user roles; limit contributor access where possible.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior, particularly new or modified pages that include shortcodes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
