Exploit for CVE-2026-89274

CVE-2026-89274 - WP Recipe Maker Arbitrary Shortcode Execution...

CVE-2026-89274

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

CVE-2026-89274 WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

CVE-2026-89274 WP Recipe Maker <= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

EUVD-2026-83476

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...

PT-2026-95743

Name of the Vulnerable Software and Affected Versions WP Recipe Maker versions prior to 10.8.2 Description An issue allows unauthenticated attackers to execute arbitrary registered WordPress shortcodes server-side on recipe page renders. This occurs because the WPRM Metadata::sanitize metadata...

CVE-2026-89274: Improper Control of Generation of Code

The WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up to, and including, 10.8.1. The vulnerability exists because WPRMMetadata::sanitizemetadata recursively calls doshortcode on every scalar field of the recipe's structured metadata array —...