CVE-2025-62897

The WP Recipe Maker plugin for WordPress (versions up to and including 10.8.1) is vulnerable to arbitrary shortcode execution. The sanitize_metadata() function recursively calls do_shortcode() on recipe metadata fields, including reviewBody populated from comment content, without sanitizing shortcode tokens before execution. Unauthenticated attackers can execute arbitrary registered shortcodes on every recipe page render, disclosing data in JSON-LD metadata.

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to and including 10.8.1 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts.

The WP Recipe Maker plugin for WordPress up to version 10.8.0 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access and above can take ownership of admin-authored recipes and unpublish them.