# CVE-2026-90884: WP Recipe Maker stored cross-site scripting in notes parameter

Source: https://junglewise.ai/threats/cve-2026-90884-wp-recipe-maker-stored-cross-site-scripting-in-notes-parameter  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-09-18. Updated: 2026-09-26  
License: CC BY 4.0 with a link back

CVE-2026-90884 · Severity: medium · CVSS 5.4 · Published 2026-09-18

The WP Recipe Maker plugin for WordPress allows authenticated users with contributor-level access or higher to inject malicious JavaScript code into recipe notes. When other users view pages containing these notes, the injected scripts execute in their browsers, potentially allowing attackers to steal session credentials, modify page content, or redirect users to malicious sites. This vulnerability affects all versions up to 10.8.1.

Technologies: [WP Recipe Maker](https://junglewise.ai/threats/technologies/wp-recipe-maker). Vendors: [WP Recipe Maker](https://junglewise.ai/threats/vendors/wp-recipe-maker).

## Quick answers

**Is CVE-2026-90884 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-90884 being exploited in the wild.

**How severe is CVE-2026-90884?** Medium severity, with a CVSS score of 5.4, published 18 September 2026.

**Which products and versions are affected?** WP Recipe Maker up to 10.8.1.

**Is there a fix for CVE-2026-90884?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-90884 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-90884?** Check whether you run WP Recipe Maker at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

This is a stored cross-site scripting (XSS) vulnerability in the WP Recipe Maker plugin caused by insufficient input sanitization and output escaping of the 'notes' parameter. The vulnerable component fails to properly sanitize user input before storing it in the database and does not properly escape output when displaying the notes to users. The attack vector requires network access and authenticated access at the Contributor level or above, making it accessible to legitimate site contributors. An attacker can inject arbitrary JavaScript that persists in the database and executes in the browsers of any user viewing the affected recipe page. Patches are available in versions after 10.8.1.

## Affected products

- WP Recipe Maker WP Recipe Maker up to 10.8.1

## Timeline

- 2026-09-18: disclosed

## References

- [https://plugins.trac.wordpress.org/changeset/3699793/](https://plugins.trac.wordpress.org/changeset/3699793/)
- [https://www.wordfence.com/threat-intel/vulnerabilities/id/7238a6ba-4ef2-4ae1-ba20-7e0a499c98a9?source=cve](https://www.wordfence.com/threat-intel/vulnerabilities/id/7238a6ba-4ef2-4ae1-ba20-7e0a499c98a9?source=cve)

## Related threats

- [WP Recipe Maker sensitive data disclosure in password-protected posts](https://junglewise.ai/threats/cve-2026-122060-the-wp-recipe-maker-wordpress-plugin-before-10-9-2-does-not)
- [WP Recipe Maker authorization bypass in REST API](https://junglewise.ai/threats/cve-2026-86608-the-wp-recipe-maker-wordpress-plugin-before-10-8-2-does-not-have)
- [WP Recipe Maker information disclosure in AJAX action](https://junglewise.ai/threats/cve-2026-86603-the-wp-recipe-maker-wordpress-plugin-before-10-8-2-does-not-have)
- [WP Recipe Maker arbitrary shortcode execution](https://junglewise.ai/threats/cve-2026-89274-the-wp-recipe-maker-plugin-for-wordpress-is-vulnerable-to)
- [WP Recipe Maker authorization bypass in recipe ownership](https://junglewise.ai/threats/cve-2026-75905-wp-recipe-maker-authorization-bypass-in-recipe-ownership)