UpMenu – Online ordering for restaurants

UpMenu – Online ordering for restaurants has one disclosed vulnerability in the WordSec catalog, all reported in 2026; it is fixed as of September 2026. Their average CVSS score is 6.4, and the most serious one scores 6.4 out of 10.

The most common weakness is Cross-Site Scripting, behind 1 of the records (100%).

The one issue recorded for UpMenu – Online ordering for restaurants has a vendor fix available, so running the current release closes it.

All of these findings were reported by Muhammad Yudha - DJ. UpMenu – Online ordering for restaurants is installed on roughly 30 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.

Strategic Overview

Avg CVSSMedium

6.4/ 10

Patch Coverage100%

Open

Fixed

Get automatic notifications for all UpMenu – Online ordering for restaurants vulnerabilities before they are exploited.

Highest severity on recordCVSS 6.4CVE-2026-1910

UpMenu <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute

Read the full analysis

Vulnerability Records

1 records


2026-02-13 18:33	UpMenu <= 3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'upmenu-menu' Shortcode 'lang' Attribute UpMenu <= 3.1	`CVE-2026-1910`	6.4 Medium	Muhammad Yudha - DJ	Yes

Showing 1–1 of 1 reports

Latestv3.2

UpMenu – Online ordering for restaurants

Author

upmenu

0.0(0)

0/100

Last Updated

2026-05-21 (4mo ago)

Active Installs

30+

Downloads

2,056

Requires WP

4.6+

Requires PHP

Tested up to

WP 7.0.4

Created

2018-12-31 (8y ago)

UpMenu is everything your restaurant needs for you to take your customers’ orders directly from your website or app while protecting your bottom line from third-party aggregators and enabling you to grow your revenue.

View on WordPress.org