WPPizza – A Restaurant Plugin
WPPizza – A Restaurant Plugin has 8 disclosed vulnerabilities in the WordSec catalog, reported between 2014 and 2026; all 8 are fixed as of September 2026. Their average CVSS score is 5.4, and the most serious one scores 6.1 out of 10. 2025 was the busiest year with 2 disclosures.
The most common weakness is Cross-Site Scripting, behind 5 of the records (63%). Other recurring categories include Missing Authorization, Exposure Of Sensitive Information To An Unauthorized Actor.
Every one of the 8 issues recorded for WPPizza – A Restaurant Plugin has a vendor fix available, so running the current release closes all known holes.
8 independent researchers contributed these findings, one record each. WPPizza – A Restaurant Plugin is installed on roughly 1,000 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.1.
CVE-2025-26991WPPizza <= 3.19.4 - Reflected Cross-Site Scripting
Read the full analysisVulnerability Records
WPPizza – A Restaurant Plugin
Author
ollybach
Conceived for Pizza Delivery Businesses, but flexible enough to serve any restaurant type. Maintain your restaurant menu online and accept cash on delivery orders. Set categories, multiple prices per item and descriptions. Several layouts inbuilt(Default, Responsive, Grid). New order notifications. Opening/Closing times per day. Allow tips/gratuities. Simple discounts. Multiple taxrates. Order reports. Multilingual Frontend (just update labels in admin settings page and/or widget as required). WPML compatible. Multisite enabled. Keeps track of your online orders. Shortcode enabled. (see complete shortcode list) Many other additional options inbuilt. To see the plugin in action with different themes try it at demo.wp-pizza.com If you wish to allow your customers to add additional ingredients to any given menu item, have a look at the premium “WPPizza Add Ingredients” extension Premium extensions available: Add Ingredients (Toppings) – (Demo) Delivery By Post/ZipCode – (Demo) Cross-Sells – (Demo) Pickup Prices – (Demo) Preorder – (Demo) Stockmanagement – (Details / Screenshots) Coupons and Discounts – (Demo) Timed Menu – (Demo) Rewards – (Details / Screenshots) Confirm | Reject | Notify – (Details / Screenshots) PDF Invoices – (Details / Screenshots) Mailinglists – (Details / Screenshots) Autoprint – (Details / Screenshots) Goodcom Printers – (Details / Screenshots) Additional payment gateways to process credit card payments instead of just “Cash on Delivery” PayPal Stripe Authorize.net Sofort Rabobank Sisow Mollie Marcadopago … and more … Translations provided by: Italien: Silvia Palandri Hebrew: Yair10 [הלב בניית אתרים ] Dutch: Jelmer Spanish: Andrew Kurtis at WebHostingHub German: Franz Rufnak, Witali Opfer Many, many thanks guys and girls. Note: As the plugin gets updated over time and has some other strings and features added, the translations above (and future ones) are likely to have some not-yet-translated strings. If you wish, feel free to provide any of those missing and I will update the translations accordingly. If you want to contribute your own translation, feel free to send me your files and I will be more than happy to include them. Demo Icons: Please note that the icons used in the demo installation are iconarchive.com icons and not for commercial use. If you do wish to use any icon from this set commercially, please follow this link to purchase it. Allergen/Foodtype Icons (credit where credit is due): Allergen/Foodtype Icons – though modified and with the exceptions stated below – are courtesy of icon-icons.com Foodtype Vegetarian/Vegan Icons courtesy of vectorstock.com Halal/Kosher Icons specifically created for this plugin. Note: Allergen/Foodtype Icons included with this plugin can be used on your site ‘as is’ and without any attribution Loading Icon: “Double Ring” Loading Icon SVG (v3.13+) generated at loading.io
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C