EUVD-2026-87535

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...

CVE-2026-92411 WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...

CVE-2026-92411: Improper Neutralization of Input During Web Page Generation

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...

PT-2026-99247

Name of the Vulnerable Software and Affected Versions WP Delicious WordPress plugin versions prior to 1.10.8 Description Insufficient validation and escaping of HTML tag names derived from user-supplied recipe block data allows users with the Contributor role and above to inject arbitrary HTML...

Exploit for CVE-2026-89274

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution...

CVE-2026-86601

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

EUVD-2026-85188

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-86601 WP Recipe Maker < 10.8.2 - Unauthenticated Arbitrary Shortcode Execution via Comment Content

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes...

CVE-2026-86601

The WP Recipe Maker WordPress plugin, in versions prior to 10.8.2 , is vulnerable to unauthenticated arbitrary shortcode execution . The root cause is the failure to remove shortcodes from comment content before expanding them during the generation of a page's structured metadata . This flaw allo...

CVE-2026-86608

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-86602

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...

CVE-2026-86603

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

CVE-2026-86608 WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-86608

The WP Recipe Maker WordPress plugin (versions 9.8.0-10.8.1 ) is vulnerable to an unauthenticated Denial of Service (DoS) . The flaw exists because one of the plugin's REST routes lacks proper authorization checks and fails to bound the data it stores. This allows unauthenticated attackers to wri...

EUVD-2026-85044

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

CVE-2026-86608 WP Recipe Maker 9.8.0 - 10.8.1 - Unauthenticated DoS via Unbounded User Meta Insertion

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its REST routes, nor does it bound what that route stores, allowing unauthenticated users to write unlimited data into any user's metadata and to permanently prevent that account, including an...

WordPress WP Recipe Maker plugin 9.8.0-10.8.1 - Unauthenticated DoS vulnerability

Unauthenticated DoS vulnerability discovered by Isuka sanuj in WordPress Plugin WP Recipe Maker versions 9.8.0-10.8.1...

CVE-2026-86603 WP Recipe Maker < 10.8.2 - Subscriber+ Non-Public List Title Disclosure via wprm_search_lists

The WP Recipe Maker WordPress plugin before 10.8.2 does not have any authorisation check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to retrieve the IDs and titles of other users' unpublished lists...

CVE-2026-86602 WP Recipe Maker 10.3.0 - 10.8.1 - Subscriber+ Draft and Private Recipe Content Disclosure via wprm_shortcode_preview

The WP Recipe Maker WordPress plugin before 10.8.2 does not perform any capability check in one of its AJAX actions, allowing any authenticated user, such as a subscriber, to read the full content of unpublished recipes...