Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

13 records

Vendor: Bootstrapped Component: Wp Recipe Maker Clear all filters
TI-2024-08952 CVE-2024-9650 · GHSA-89h4-pc7j-mhf2

WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'

Priority LOW 31

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tooltip’ parameter in all versions up to, and including, 9.6.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00402 Published 2024-10-24 No fix listed CWE-79
TI-2024-00349 CVE-2024-0383 · GHSA-cr9m-gqfc-9rv7

WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag'

Priority LOW 29

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's [wprm-recipe-instructions] and [wprm-recipe-ingredients] shortcodes in all versions up to, and including, 9.1.0 due t…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00449 Published 2024-06-19 No fix listed CWE-79
TI-2024-03255 CVE-2024-3490 · GHSA-96hm-xqc5-vqv9

Cross-site scripting in brechtvds WP Recipe Maker

Priority LOW 28

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's wprm-recipe-roundup-item shortcode in all versions up to, and including, 9.3.1 due to insufficient input sanitization…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.0032 Published 2024-05-02 No fix listed CWE-79
TI-2024-01467 CVE-2024-1571 · GHSA-3qr9-mgq6-hx96

WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed

Priority LOW 22

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, and including, 9.2.1 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00422 Published 2024-04-09 No fix listed CWE-79
TI-2024-01121 CVE-2024-1206 · GHSA-ph8r-7w28-hh7p

WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton

Priority MEDIUM 41

The WP Recipe Maker plugin for WordPress is vulnerable to SQL Injection via the 'recipes' parameter in all versions up to, and including, 9.1.2 due to insufficient escaping on the user supplied parameter and lack of suff…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00734 Published 2024-02-20 No fix listed CWE-89
TI-2024-00230 CVE-2024-0255 · GHSA-rqqw-5q6g-cjxv

WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color

Priority LOW 29

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-recipe-text-share' shortcode in all versions up to, and including, 9.1.0 due to insufficient input sanitization…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00518 Published 2024-02-05 No fix listed CWE-79
TI-2024-00346 CVE-2024-0380 · GHSA-wf9p-gjmq-pmx9

WP Recipe Maker <= 9.1.0 - Directory Traversal

Priority LOW 26

The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.0 via the 'icon' attribute used in Shortcodes.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00803 Published 2024-02-05 No fix listed CWE-22
TI-2024-00348 CVE-2024-0382 · GHSA-rpxv-j4q4-prcp

WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag

Priority LOW 29

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0 due to unrestricted use of the 'header_tag' attribute.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00557 Published 2024-02-05 No fix listed CWE-79
TI-2023-06360 CVE-2023-6958 · GHSA-6cp2-4r62-fxjp

WP Recipe Maker <= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode

Priority LOW 28

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping o…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00335 Published 2024-01-18 No fix listed CWE-79
TI-2024-00347 CVE-2024-0381 · GHSA-6qpr-gwh6-27m6

WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag'

Priority LOW 29

The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes in all versions up to…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00578 Published 2024-01-18 No fix listed CWE-79
TI-2023-06372 CVE-2023-6970 · GHSA-xgmr-mh2m-j5vq

WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer

Priority LOW 28

The WP Recipe Maker plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘Referer' header in all versions up to, and including, 9.1.0 due to insufficient input sanitization and output escaping.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00673 Published 2024-01-18 No fix listed CWE-79
TI-2022-04083 CVE-2022-4468 · GHSA-2w97-hhmp-jmj9

WP Recipe Maker < 8.6.1 - Contributor+ Stored XSS

Priority MEDIUM 58

The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perfor…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00539 Published 2023-01-09 Fixed in 8.6.1