CVE-2026-90884 in WP Recipe Maker Plugin
Summary
by MITRE • 09/18/2026
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'notes' parameter in all versions up to, and including, 10.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/18/2026
The WP Recipe Maker plugin, a widely utilized tool within the WordPress ecosystem for creating and managing culinary content, has been identified as containing a significant security flaw affecting all versions up through 10.8.1. This vulnerability is classified as a Stored Cross-Site Scripting issue, which represents one of the most persistent and dangerous categories of web application vulnerabilities due to its ability to compromise multiple users rather than just an individual session initiator. The root cause lies in insufficient input sanitization and output escaping mechanisms within the plugin's codebase. Specifically, the 'notes' parameter fails to properly validate or encode user-supplied data before it is stored in the database and subsequently rendered on web pages without appropriate encoding. This lack of rigorous handling allows malicious actors to inject arbitrary JavaScript payloads that are permanently saved alongside legitimate recipe content.
The operational impact of this vulnerability is severe because it requires only Contributor-level access or higher for exploitation, a privilege level commonly granted to authors, editors, and other non-administrative users who contribute content. Once an attacker with such credentials successfully submits a crafted payload via the 'notes' field, the malicious script becomes part of the stored data structure. Consequently, every subsequent user who views the affected recipe page will have their browser execute the injected code automatically. This mechanism enables attackers to perform session hijacking by stealing administrative cookies or authentication tokens, redirect users to phishing sites designed to capture credentials, deface websites, or distribute malware through drive-by download techniques. The persistence of this attack vector means that even if the initial attacker is removed from the system, the malicious script remains active until the compromised content is manually cleaned and the plugin is updated.
From a technical classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific nature of storing the payload for later execution places it firmly within the Stored XSS category rather than Reflected or DOM-based variants. In terms of adversary behavior mapping according to the MITRE ATT&CK framework, this exploit corresponds to techniques involving Client-side Injection and potentially Account Manipulation if used to escalate privileges by stealing session tokens from administrators who view the compromised pages. The attack chain typically involves Initial Access via valid credentials, followed by Execution through browser-based script injection, leading to Credential Access or Collection of sensitive data stored in local storage or cookies.
Mitigation strategies must focus on immediate remediation and long-term hardening practices. Administrators should upgrade the WP Recipe Maker plugin to version 10.8.2 or later as soon as possible, where developers have implemented proper input sanitization using functions like wp_kses_post or similar escaping mechanisms for output rendering. Until an update is applied, it is advisable to restrict contributor-level access to trusted individuals only and monitor user-generated content for suspicious scripts. Additionally, implementing a Web Application Firewall can provide a layer of defense by filtering out malicious payloads before they reach the application logic. Security teams should also enforce strict Content Security Policy headers where feasible to mitigate the impact of any successfully injected scripts by restricting script execution sources. Regular security audits and code reviews focusing on input validation and output encoding are essential to prevent similar vulnerabilities in future plugin updates or custom developments within the WordPress environment.