Executive brief
WP Recipe Maker Premium is a WordPress plugin that provides recipe management and display functionality. The plugin contains a stored XSS vulnerability in its 'wprm-call-to-action' shortcode that allows contributor-level users to inject malicious scripts into pages. When visitors view the affected page, the injected scripts execute in their browsers, potentially leading to account compromise, credential theft, or unauthorized actions.
Technical details
The vulnerability is a stored cross-site scripting (XSS) flaw in the 'wprm-call-to-action' shortcode caused by insufficient input sanitization and output escaping on user-supplied attributes. The shortcode accepts user input through its attributes without proper validation or escaping before storing and rendering the content. Authenticated attackers with contributor-level access or above can inject arbitrary HTML and JavaScript into shortcode attributes, which is then stored in the page and executed whenever the page is accessed. The vulnerability affects all versions up to and including 10.5.0, and patches were released in version 10.8.1 (2026-09-03) as documented in the plugin's changelog.
Affected products
- Bootstrapped Ventures WP Recipe Maker Premium up to and including 10.5.0
Timeline
- 2026-09-01: disclosed: CVE-2026-7877 published
- 2026-09-03: patched: Fixed in WP Recipe Maker 10.8.1 with XSS prevention in shortcode execution