Stored Cross-Site Scripting Vulnerability in WP Recipe Maker Plugin for WordPress

CVE-2024-0381

Summary

The WP Recipe Maker plugin for WordPress is compromised by a Stored Cross-Site Scripting vulnerability that affects all versions up to and including 9.1.0. This vulnerability allows authenticated attackers with contributor-level permissions or higher to exploit the 'tag' attribute within the shortcodes for recipe name, date, and counter. By leveraging this flaw, attackers can inject arbitrary web scripts that execute when users access compromised pages, potentially leading to unauthorized actions or data theft.

References