Executive brief
The WP Recipe Maker plugin for WordPress allows authenticated users with contributor-level access or higher to inject malicious JavaScript code into recipe notes. When other users view pages containing these notes, the injected scripts execute in their browsers, potentially allowing attackers to steal session credentials, modify page content, or redirect users to malicious sites. This vulnerability affects all versions up to 10.8.1.
Technical details
This is a stored cross-site scripting (XSS) vulnerability in the WP Recipe Maker plugin caused by insufficient input sanitization and output escaping of the 'notes' parameter. The vulnerable component fails to properly sanitize user input before storing it in the database and does not properly escape output when displaying the notes to users. The attack vector requires network access and authenticated access at the Contributor level or above, making it accessible to legitimate site contributors. An attacker can inject arbitrary JavaScript that persists in the database and executes in the browsers of any user viewing the affected recipe page. Patches are available in versions after 10.8.1.
Affected products
- WP Recipe Maker WP Recipe Maker up to 10.8.1
Timeline
- 2026-09-18: disclosed