Stored Cross-Site Scripting Vulnerability in WP Recipe Maker Plugin by WordPress
CVE-2024-0382
5.4MEDIUM
Key Information:
- Vendor
Wordpress
- Status
- Vendor
- CVE Published:
- 5 February 2024
What is CVE-2024-0382?
The WP Recipe Maker plugin for WordPress has a vulnerability that allows authenticated users with contributor-level permissions and above to exploit stored cross-site scripting (XSS). This occurs through the plugin's shortcode(s) due to the unrestricted use of the 'header_tag' attribute. Attackers can inject arbitrary web scripts into the pages, which are executed whenever a user visits the altered page, potentially compromising user data and site integrity.
Affected Version(s)
WP Recipe Maker * <= 9.1.0