Input validation vulnerability in WP Food Manager – WordPress Restaurant Menu Plugin 1.0.3

The WP Food Manager plugin is vulnerable to a type of attack known as Stored Cross-Site Scripting when using versions up to 1.0.3. This type of attack allows someone with administrator-level access to inject malicious scripts into a website. When a user visits the page with the malicious code, the code can take control of the user’s actions on the page, or even steal personal information. This type of attack is only possible if the website is a multi-site installation or if a special type of security, known as unfiltered_html, has been disabled.