Wp Recipe Maker
Approved changes feed: RSS · Atom
cpe:2.3:a:unknown:wp_recipe_maker:*:*:*:*:*:*:*:*part: a version: * update: *
| Vendor | Unknown (668ca391-a6cc-5e33-879b-83885214de33) |
|---|---|
| Product | Wp Recipe Maker (f21118f7-a06b-5fd6-a4f8-5d322a43cadb) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2026-86603 |
vulnerable | 2026-10-13 12:28:46.587503 |
WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists.
Published: 2026-09-23T06:00:18.655Z
Updated: 2026-09-23T10:55:38.733Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86602 |
vulnerable | 2026-10-13 12:28:46.526231 |
WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview
The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes.
Published: 2026-09-23T06:00:18.484Z
Updated: 2026-09-23T10:55:53.223Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86608 |
vulnerable | 2026-10-13 12:28:46.325634 |
WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion
The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an administrator's, from loading.
Published: 2026-09-23T06:00:19.084Z
Updated: 2026-09-23T10:55:24.252Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2026-86601 |
vulnerable | 2026-10-13 12:28:46.193729 |
WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content
MEDIUM (6.5)
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
Published: 2026-09-23T10:11:00.353Z
Updated: 2026-09-23T10:50:16.377Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-4468 |
vulnerable | 2026-06-08 05:51:59.540740 |
WP Recipe Maker < 8.6.1 - Contributor+ Stored XSS
The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Published: 2023-01-09T22:13:32.184Z
Updated: 2025-04-09T19:01:04.612Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.