CVE-2026-86601
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk7th percentile - higher than 7% of all known CVEs
Summary
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
Risk Assessment
An attacker can execute arbitrary shortcodes server-side and access unpublished content, potentially leading to leakage of confidential information and data integrity compromise.
Recommendation
Update the WP Recipe Maker plugin to version 10.8.2 or later, which includes a fix to remove shortcodes from comment content before expansion.
Other vulnerabilities in WP Recipe Maker
See all- CVE-2026-89274Critical
The WP Recipe Maker plugin for WordPress (versions up to and including 10.8.1) is vulnerable to arbitrary shortcode execution. The sanitize_metadata() function recursively calls do_shortcode() on recipe metadata fields, including reviewBody populated from comment content, without sanitizing shortcode tokens before execution. Unauthenticated attackers can execute arbitrary registered shortcodes on every recipe page render, disclosing data in JSON-LD metadata.
- CVE-2026-86608High
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.
- CVE-2026-90884Medium
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to and including 10.8.1 due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access and above can inject arbitrary web scripts.
- CVE-2026-75905Medium
The WP Recipe Maker plugin for WordPress up to version 10.8.0 is vulnerable to authorization bypass. Authenticated attackers with contributor-level access and above can take ownership of admin-authored recipes and unpublish them.
Original NVD description (English source)
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS