Skip to content
Noroxi

WP Recipe Maker

wp-recipe-maker · plugin

Known security vulnerabilities for WP Recipe Maker. Find out in seconds which version runs on your site with WP Lens.

21 known vulnerabilities

1 critical · 4 exploitable without logging in · 2 with public exploit code · latest Sep 18, 2026

Listed on wordpress.org · latest 10.8.5 · last updated Sep 21, 2026 · 50K+ installs

wordpress.org status checked on Oct 4, 2026

Vulnerabilities

  • CVE-2026-89274unauthenticated≤ 10.8.1

    WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

    Critical 9.1

  • CVE-2024-1206subscriber+≤ 9.1.2

    WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton

    High 8.8

  • CVE-2025-14385contributor+≤ 10.2.3

    WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 6.4

  • CVE-2025-1503contributor+≤ 9.8.0

    WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

    Medium 6.4

  • CVE-2023-6970unauthenticated · needs a click≤ 9.1.0

    WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer

    Medium 6.1

  • CVE-2024-9650contributor+≤ 9.6.1

    WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'

    Medium 5.4

  • CVE-2024-0383contributor+≤ 9.1.0

    WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag'

    Medium 5.4

  • CVE-2024-3490contributor+≤ 9.3.1

    WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode

    Medium 5.4

  • CVE-2024-0384contributor+≤ 9.1.0

    WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe Notes

    Medium 5.4

  • CVE-2024-0382contributor+≤ 9.1.0

    WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag

    Medium 5.4

  • CVE-2024-0255contributor+≤ 9.1.0

    WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color

    Medium 5.4

  • CVE-2024-0381contributor+≤ 9.1.0

    WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag'

    Medium 5.4

  • CVE-2023-6958contributor+≤ 9.1.0

    WP Recipe Maker <= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

    Medium 5.4

  • CVE-2026-1558unauthenticated≤ 10.3.2

    WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter

    Medium 5.3

  • CVE-2025-62897unauthenticated≤ 10.1.0

    WordPress WP Recipe Maker plugin < 10.1.0 - Content Injection vulnerability

    Medium 5.3

  • CVE-2024-1571high privilege≤ 9.2.1

    WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed

    Medium 4.8

  • CVE-2025-14742subscriber+≤ 10.2.3

    WP Recipe Maker <= 10.2.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure

    Medium 4.3

  • CVE-2026-24357login required≤ 10.2.4

    WordPress WP Recipe Maker plugin <= 10.2.4 - Broken Access Control vulnerability

    Medium 4.3

  • CVE-2026-75905contributor+≤ 10.8.0

    WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Short

    Medium 4.3

  • CVE-2025-15527contributor+≤ 10.2.2

    WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure

    Medium 4.3

  • CVE-2024-0380contributor+≤ 9.1.0

    WP Recipe Maker <= 9.1.0 - Directory Traversal

    Medium 4.3

The access label is read from the record's own text (e.g. “subscriber+”: subscriber and above). When the text names no role, CVSS decides between “login required” and “high privilege”; no role name is invented. “Needs a click”: the attack depends on a logged-in user following a link (CSRF, reflected XSS).

← Back to directory