CVE-2026-90884
MediumCVSS 5.4Exploitation Probability (EPSS)
Low risk13th percentile - higher than 13% of all known CVEs
Summary
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to and including 10.8.1 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts.
Risk Assessment
An attacker can inject malicious scripts that execute when a user accesses an injected page, potentially leading to data theft or session hijacking.
Recommendation
Update the plugin to the latest version and restrict user permissions.
Other vulnerabilities in WP Recipe Maker
See all- CVE-2026-89274Critical
The WP Recipe Maker plugin for WordPress (versions up to and including 10.8.1) is vulnerable to arbitrary shortcode execution. The sanitize_metadata() function recursively calls do_shortcode() on recipe metadata fields, including reviewBody populated from comment content, without sanitizing shortcode tokens before execution. Unauthenticated attackers can execute arbitrary registered shortcodes on every recipe page render, disclosing data in JSON-LD metadata.
- CVE-2026-86601Medium
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
- CVE-2026-86608High
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.
- CVE-2026-75905Medium
The WP Recipe Maker plugin for WordPress up to version 10.8.0 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access and above can take ownership of admin-authored recipes and unpublish them.
- CVE-2025-62897Medium
An Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) vulnerability in Brecht WP Recipe Maker allows Code Injection. This issue affects WP Recipe Maker from n/a through < 10.1.0.
Original NVD description (English source)
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS