Mobi2Go
Mobi2Go has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 4.4, and the most serious one scores 4.4 out of 10.
The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).
The one issue recorded for Mobi2Go has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Vinit Lakra. Mobi2Go is installed on roughly 70 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 5.3.23.
CVE-2025-58646Mobi2Go <= 1.0.0 - Authenticated (Administrator+) Stored Cross-Site Scripting
Read the full analysisVulnerability Records
Mobi2Go
Author
chtombleson
Mobi2Go is an integrated web and mobile system for your hospitality business. It’s all your restaurant or cafe needs for online ordering and increased revenue generation. Mobi2Go can help with: Online ordering Our online ordering can be embedded directly into your existing website and styled to match your brand, ensuring seamless integration. Customer ordering Our online storefront has a comprehensive suite of features, allowing your customers to order, customise products, schedule orders, earn loyalty points and pay for their order by credit card. Mobile ordering Our mobile ordering supports both iOS and Android and can be customised to match the look and feel of your brand. See examples of our work and start your free trial at mobi2go.com
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C