WR
Product
WP Recipe Maker
10
CVEs
0
On KEV
9.1
Max CVSS
0
New 30D
Severity mix
Critical 1High 0Medium 9Low 0
Watch
Add WP Recipe Maker to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-89274 | 9.1 | Sep 19 | WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content Affected: through 10.8.1 |
| CVE-2025-14385 | 6.4 | Dec 17 | WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode Affected: through 10.2.3 |
| CVE-2025-1503 | 6.4 | Mar 13 | WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting Affected: through 9.8.0 |
| CVE-2026-90884 | 5.4 | Sep 18 | WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint Affected: through 10.8.1 |
| CVE-2024-9650 | 5.4 | Oct 24 | WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip' Affected: through 9.6.1 |
| CVE-2024-0383 | 5.4 | Jun 19 | WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag' Affected: through 9.1.0 |
| CVE-2026-1558 | 5.3 | Feb 27 | WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter Affected: through 10.3.2 |
| CVE-2026-75905 | 4.3 | Sep 9 | WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode Affected: through 10.8.0 |
| CVE-2025-14742 | 4.3 | Feb 25 | WP Recipe Maker <= 10.2.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure Affected: through 10.2.3 |
| CVE-2025-15527 | 4.3 | Jan 16 | WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure Affected: through 10.2.2 |
Showing 10