CVE-2024-1571 in WP Recipe Maker Plugin
Summary
by MITRE • 04/09/2024
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, and including, 9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the recipe dashboard (which is administrator-only by default but can be assigned to arbitrary capabilities), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 04/14/2026
The WP Recipe Maker plugin for WordPress presents a critical stored cross-site scripting vulnerability identified as CVE-2024-1571 affecting versions through 9.2.1. This vulnerability stems from inadequate input sanitization and output escaping mechanisms within the plugin's handling of the Video Embed parameter. The flaw allows authenticated attackers with administrative privileges to inject malicious scripts that persist in the plugin's database and execute whenever affected pages are accessed by other users. The vulnerability specifically targets the video embedding functionality where user-supplied input is not properly validated or escaped before being stored and subsequently rendered in web pages.
The technical exploitation of this vulnerability occurs through the manipulation of the Video Embed parameter within the recipe creation interface. When an attacker with administrative access submits malicious script code through this parameter, the input passes through insufficient validation checks and gets stored in the WordPress database. Upon subsequent page rendering, the stored script executes in the context of other users' browsers who visit pages containing the compromised recipe content. This represents a classic stored XSS attack vector where the malicious payload is not reflected but rather persisted in the application's data store, making the attack more dangerous and long-lasting than reflected XSS variants. The vulnerability falls under CWE-79 which specifically addresses Cross-Site Scripting flaws in software applications.
The operational impact of CVE-2024-1571 extends beyond simple script execution as it provides attackers with potential access to sensitive administrative functions and user data. An attacker could craft malicious scripts to steal session cookies, redirect users to phishing sites, or even execute additional attacks through the compromised user sessions. The default administrative access requirement means that even if the plugin's dashboard access is restricted to specific user roles, any compromised administrator account could be leveraged to establish persistent malicious presence within the WordPress environment. This vulnerability directly aligns with ATT&CK technique T1566 which covers social engineering tactics, as the attack vector involves manipulating trusted users through the legitimate plugin interface. The impact is particularly severe because WordPress administrators typically have extensive privileges including the ability to modify content, manage users, and potentially access sensitive system information.
Mitigation strategies for CVE-2024-1571 should prioritize immediate patching of the WP Recipe Maker plugin to version 9.2.2 or later where the vulnerability has been addressed. Organizations should implement additional defensive measures including restricting administrative privileges to only essential personnel, implementing role-based access controls, and monitoring for unusual activity in the recipe management interface. Input validation should be strengthened through proper sanitization of all user-supplied content, particularly in fields that accept HTML or script content. Output escaping mechanisms must be enforced to ensure that any stored content is properly encoded when rendered in web pages. Network monitoring solutions should be configured to detect suspicious script injection patterns, and regular security audits should verify that all WordPress plugins and themes maintain current versions with security patches applied. The vulnerability demonstrates the critical importance of input validation and output escaping in preventing XSS attacks, as outlined in OWASP Top 10 security principles and the broader security framework established by the Open Web Application Security Project.