Is CVE-2026-119489 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-119489 being exploited in the wild.

How severe is CVE-2026-119489?

Medium severity, with a CVSS score of 6.5, published 7 November 2026.

Which products and versions are affected?

Bootstrapped Ventures WP Recipe Maker through 10.9.1.

Is there a fix for CVE-2026-119489?

Yes: fixed in 10.9.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-119489 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-119489?

Check whether you run Bootstrapped Ventures WP Recipe Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-119489: Bootstrapped Ventures WP Recipe Maker stored cross-site scripting

CVE-2026-119489 · Severity: medium · CVSS 6.5 · Published 2026-11-07

WP Recipe Maker is a WordPress plugin that allows websites to publish and display recipes. A stored cross-site scripting vulnerability allows contributors to inject malicious scripts that execute for all site visitors, enabling account hijacking or data theft from readers.

Vendors: Bootstrapped Ventures.

Quick answers

Is CVE-2026-119489 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-119489 being exploited in the wild.
How severe is CVE-2026-119489?: Medium severity, with a CVSS score of 6.5, published 7 November 2026.
Which products and versions are affected?: Bootstrapped Ventures WP Recipe Maker through 10.9.1.
Is there a fix for CVE-2026-119489?: Yes: fixed in 10.9.2. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-119489 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-119489?: Check whether you run Bootstrapped Ventures WP Recipe Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 10.9.2

Technical details

The plugin improperly neutralizes user input during web page generation, allowing stored XSS injection. Exploitation requires contributor-level privilege and user interaction (a visitor viewing a page with injected content). Attackers can steal visitor session tokens or credentials, or redirect users to malicious sites.

Affected products

Bootstrapped Ventures WP Recipe Maker through 10.9.1

Timeline

2026-10-26: disclosed
2026-11-07: advisory
2026-11-07: patched

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.