CVE-2021-24389: vulnerability in Chimpstudio FoodBakery
FoodBakery < 2.2 - Reflected Cross-Site Scripting (XSS)
Published · Updated
18Vexday Risk Score
Patch soon. It has a working public exploit.
ssvc Attendepss 3.8%
exploitation probability
3.8%top 10% of all CVEs
observed exploitation
nono source reports it
The WP Foodbakery WordPress plugin before 2.2, used in the FoodBakery WordPress theme before 2.2 did not properly sanitize the foodbakery_radius parameter before outputting it back in the response, leading to an unauthenticated Reflected Cross-Site Scripting (XSS) vulnerability.
Related CVEs — Chimpstudio FoodBakery
In the same product, most dangerous first.
CVE-2024-13011CRITICALWP Foodbakery <= 4.7 - Unauthenticated Arbitrary File UploadEPSS 0.9%CVE-2026-15802HIGHWP Foodbakery <= 4.9 - Authenticated (Subscriber+) Arbitrary File Deletion via via delete_locations_backup_file AJAX ActionEPSS 0.8%CVE-2025-0181CRITICALWP Foodbakery <= 4.8 - Authentication Bypass in foodbakery_parse_requestEPSS 0.6%CVE-2025-0180CRITICALWP Foodbakery <= 4.7 - Unauthenticated Privilege Escalation in foodbakery_registration_validationEPSS 0.5%CVE-2025-32927CRITICALWordPress FoodBakery plugin <= 3.3 - PHP Object Injection vulnerabilityEPSS 0.5%CVE-2026-78530HIGHWordPress FoodBakery theme <= 4.6 - Arbitrary File Deletion vulnerabilityEPSS 0.4%