Directory Traversal in WP Recipe Maker Plugin for WordPress
CVE-2024-0380
4.3MEDIUM
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 5 February 2024
What is CVE-2024-0380?
The WP Recipe Maker plugin for WordPress exposes a directory traversal vulnerability that allows authenticated attackers with contributor-level access and above to exploit the 'icon' attribute in Shortcodes. By leveraging this vulnerability, attackers can include the contents of SVG files residing on the server, which may lead to Cross-Site Scripting (XSS) attacks, potentially compromising user data and site integrity.
Affected Version(s)
WP Recipe Maker * <= 9.1.0