WP Recipe Maker < 10.1.0 - Unauthenticated Arbitrary Shortcode Execution

Wordfence Intelligence   >   Vulnerability Database   >   WP Recipe Maker < 10.1.0 - Unauthenticated Arbitrary Shortcode Execution
5.3
Improper Control of Generation of Code ('Code Injection')
CVE CVE-2025-62897
CVSS 5.3 (Medium)
Publicly Published September 26, 2025
Last Updated October 29, 2025
Researcher Najib Sinjari

Description

The The WP Recipe Maker plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to 10.1.0 (exclusive). This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for unauthenticated attackers to execute arbitrary shortcodes.

References

Share

Vulnerability Details for WP Recipe Maker

WP Recipe Maker

Software Type Plugin
Software Slug wp-recipe-maker (view on wordpress.org)
Patched? Yes
Remediation Update to version 10.1.0, or a newer patched version
Affected Version
  • < 10.1.0
Patched Version
  • 10.1.0

Recent vulnerabilities in WP Recipe Maker

WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter
5.3
CVE-2026-1558
Feb 26, 2026
Researcher: Quốc Huy (jtwings)
WP Recipe Maker <= 10.6.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure
4.3
CVE-2025-14742
Feb 24, 2026
Researcher: Abhinav Jaswal (wrath_exe)
Recipe Maker <= 10.2.4 - Missing Authorization
4.3
CVE-2026-24357
Jan 28, 2026
Researcher: daroo
WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode
6.4
CVE-2025-14385
Dec 16, 2025
Researcher: Abhinav Jaswal (wrath_exe)
WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure
4.3
CVE-2025-15527
Dec 11, 2025
Researcher: Dmitrii Ignatyev
WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting
6.4
CVE-2025-1503
Mar 12, 2025
Researcher: zer0gh0st
WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip'
6.5
CVE-2024-9650
Oct 23, 2024
Researcher: Webbernaut
WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag'
6.4
CVE-2024-0383
Jun 18, 2024
Researcher: wesley (wcraft)
WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode
6.4
CVE-2024-3490
May 1, 2024
Researcher: stealthcopter
WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed
4.4
CVE-2024-1571
Mar 14, 2024
Researcher: catfather
# Title CVE ID CVSS Researchers Date
1 WP Recipe Maker <= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter CVE-2026-1558 5.3 Quốc Huy (jtwings) February 26, 2026
2 WP Recipe Maker <= 10.6.0 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure CVE-2025-14742 4.3 Abhinav Jaswal (wrath_exe) February 24, 2026
3 Recipe Maker <= 10.2.4 - Missing Authorization CVE-2026-24357 4.3 daroo January 28, 2026
4 WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode CVE-2025-14385 6.4 Abhinav Jaswal (wrath_exe) December 16, 2025
5 WP Recipe Maker <= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure CVE-2025-15527 4.3 Dmitrii Ignatyev December 11, 2025
6 WP Recipe Maker <= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting CVE-2025-1503 6.4 zer0gh0st March 12, 2025
7 WP Recipe Maker <= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip' CVE-2024-9650 6.5 Webbernaut October 23, 2024
8 WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group_tag' CVE-2024-0383 6.4 wesley (wcraft) June 18, 2024
9 WP Recipe Maker <= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode CVE-2024-3490 6.4 stealthcopter May 1, 2024
10 WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed CVE-2024-1571 4.4 catfather March 14, 2024
View more vulnerabilities in this software package View more vulnerabilities

This record contains material that is subject to copyright.

Copyright 2012-2026 Defiant Inc.

License: Defiant hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute this software vulnerability information. Any copy of the software vulnerability information you make for such purposes is authorized provided that you include a hyperlink to this vulnerability record and reproduce Defiant's copyright designation and this license in any such copy. Read more.

Copyright 1999-2026 The MITRE Corporation

License: CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE®). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. Read more.

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation