What’s Vulnerable › Products

brechtvds WP Recipe Maker vulnerabilities

25 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 12 published in the last 12 months.

Check whether your brechtvds WP Recipe Maker version is affected

Latest brechtvds WP Recipe Maker vulnerabilities

• CVE-2026-86601 — WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content (CVSS 6.5)
• CVE-2026-86608 — WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion (CVSS 8.2)
• CVE-2026-86603 — WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists (CVSS 4.3)
• CVE-2026-86602 — WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview (CVSS 4.3)
• CVE-2026-89274 — WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content (CVSS 9.1)
• CVE-2026-90884 — WP Recipe Maker <= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint (CVSS 5.4)
• CVE-2026-75905 — WP Recipe Maker <= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '[wprm-recipe]' Shortcode (CVSS 4.3)
• CVE-2026-1558 — WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter (CVSS 5.3)
• CVE-2025-14742 — WP Recipe Maker <= 10.2.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3)
• CVE-2025-15527 — WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 4.3)
• CVE-2025-14385 — WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
• CVE-2025-1503 — WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
• CVE-2024-9650 — WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip' (CVSS 5.4)
• CVE-2024-0383 — WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag' (CVSS 5.4)
• CVE-2024-3490 — WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode (CVSS 5.4)
• CVE-2024-1571 — WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed (CVSS 4.8)
• CVE-2024-1206 — WP Recipe Maker <= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton (CVSS 8.8)
• CVE-2024-0384 — WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe Notes (CVSS 5.4)
• CVE-2024-0382 — WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag (CVSS 5.4)
• CVE-2024-0380 — WP Recipe Maker <= 9.1.0 - Directory Traversal (CVSS 4.3)
• CVE-2024-0255 — WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon_color (CVSS 5.4)
• CVE-2024-0381 — WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' (CVSS 5.4)
• CVE-2023-6970 — WP Recipe Maker <= 9.1.0 - Reflected Cross-Site Scripting via Referer (CVSS 6.1)
• CVE-2023-6958 — WP Recipe Maker <= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 5.4)
• CVE-2022-4468 — WP Recipe Maker < 8.6.1 - Contributor+ Stored XSS (CVSS 5.4)