Advisories · Technology
brechtvds WP Recipe Maker.
Every CVE that names brechtvds WP Recipe Maker among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 9.1 CriticalCritical · CVSS 9+
WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content
- brechtvds WP Recipe Maker
- Code injection
- CVSS 5.4 Medium
WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 4.3 Medium
WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode
- brechtvds WP Recipe Maker
- Broken access control
- CVSS 5.3 Medium
WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter
- brechtvds WP Recipe Maker
- Broken access control
- CVSS 4.3 Medium
WP Recipe Maker <= 10.2.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
- brechtvds WP Recipe Maker
- Broken access control
- CVSS 4.3 Medium
WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure
- brechtvds WP Recipe Maker
- Information disclosure
- CVSS 6.4 Medium
WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 6.5 Medium
WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag'
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 4.4 Medium
WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 8.8 High
WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton
- brechtvds WP Recipe Maker
- SQL injection
- CVSS 6.4 Medium
WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe Notes
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 5.4 Medium
WP Recipe Maker <= 9.1.0 - Directory Traversal
- brechtvds WP Recipe Maker
- Path traversal
- CVSS 6.4 Medium
WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Recipe Maker <= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 6.4 Medium
WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag'
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)
- CVSS 6.1 Medium
WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer
- brechtvds WP Recipe Maker
- Cross-site scripting (XSS)