Description

The WP Recipe Maker Premium plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'wprm-call-to-action' shortcode in all versions up to, and including, 10.5.0 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.4",
  "pubDate": "2026-09-01T13:19:59.843Z",
  "pubdate": "2026-09-01T13:19:59.843Z",
  "executiveSummary": "The WP Recipe Maker Premium plugin for WordPress is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability residing within the 'wprm-call-to-action' shortcode functionality. This flaw, present in versions up to and including 10.5.0, arises from inadequate input sanitization and output escaping of user-supplied shortcode attributes.\nThe vulnerability permits an authenticated attacker, holding a minimum privilege level of Contributor, to inject malicious JavaScript payloads directly into the application's database. When a victim, such as an administrator or another user, navigates to a page containing the compromised shortcode, the injected script executes within the context of their session.\nThe impact of this vulnerability is significant, as it enables session hijacking, unauthorized actions performed on behalf of the victim, and potential exfiltration of sensitive data. Exploitation requires authenticated access to the WordPress dashboard, specifically the capability to author or edit content where shortcodes can be inserted. Given that the Contributor role is often assigned to external writers, the risk of exploitation by malicious insiders or compromised accounts is elevated.",
  "technicalDetails": "The vulnerability originates from the 'wprm-call-to-action' shortcode handler within the WP Recipe Maker Premium plugin. The plugin fails to perform rigorous server-side validation or sanitization of input attributes provided within the shortcode syntax before storing them in the WordPress database.\nFurthermore, the plugin lacks context-aware output escaping when rendering these attributes on the front-end, allowing an attacker to break out of the HTML attribute context and inject arbitrary JavaScript tags. An attacker with Contributor-level privileges can insert the vulnerable shortcode into a post or page using the WordPress editor. By crafting a payload such as [wprm-call-to-action link='javascript:alert(1)'] or similar variations involving event handlers like 'onmouseover', the attacker can trigger malicious code execution.\nThe attack flow follows a deterministic pattern: 1) An authenticated attacker inserts the malicious shortcode into a post or page content field. 2) The WordPress engine processes the shortcode, and the plugin incorrectly sanitizes the provided attributes, storing the raw, malicious payload in the 'wp_posts' or 'wp_postmeta' table. 3) A victim user visits the rendered page containing the shortcode. 4) The plugin retrieves the malicious payload from the database and embeds it directly into the HTML response without proper sanitization or context-aware escaping. 5) The victim's browser interprets the malicious content as executable script, leading to client-side code execution.\nThe scope of this vulnerability encompasses all versions of the WP Recipe Maker Premium plugin up to and including 10.5.0. Because the execution occurs in the browser of any user viewing the page, the impact is not limited to the attacker's account. If an administrator visits the page, the script can perform administrative actions, such as creating new user accounts, modifying plugin settings, or redirecting traffic, due to the implicit trust WordPress places in administrative sessions. The lack of output encoding acts as the primary failure point, transforming persistent stored data into an active security threat."
}