WordPress FoodBakery <2.2 - Cross-Site Scripting Detection

WordPress FoodBakery before 2.2 contains an unauthenticated reflected cross-site scripting vulnerability. It does not properly sanitize the foodbakeryradius parameter before outputting it back in the response. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress FoodBakery before 2.""" from...

CVE-2026-15802

The CVE covers the WP Foodbakery WordPress plugin. Affected: all versions up to 4.9. Vulnerability: arbitrary file deletion due to insufficient validation in delete_locations_backup_file_callback. Impact: authenticated attackers with subscriber-level access can delete arbitrary files on the serve...

CVE-2025-32927 WordPress FoodBakery plugin <= 3.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Chimpstudio FoodBakery wp-foodbakery allows Object Injection.This issue affects FoodBakery: from n/a through = 3.3...

CVE-2025-39356 WordPress Foodbakery Sticky Cart plugin <= 3.2 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in Chimpstudio Foodbakery Sticky Cart foodbakery-sticky-cart allows Object Injection.This issue affects Foodbakery Sticky Cart: from n/a through = 3.2...

WordPress FoodBakery plugin <= 3.3 - PHP Object Injection vulnerability

PHP Object Injection vulnerability discovered by Bonds Patchstack Alliance in WordPress Plugin FoodBakery versions = 3.3...