Security Alert Summary
The WP Recipe Maker Premium WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in its wprm-call-to-action shortcode. Authenticated users with contributor-level access or higher can supply attributes that are not properly sanitized or escaped, allowing injected scripts to execute when a page containing the shortcode is viewed.
CVE Details
- CVE ID: CVE-2026-7877
- Affected component: WP Recipe Maker Premium plugin for WordPress
- Affected versions: All versions up to and including 10.5.0
- Published: September 1, 2026 at 1:19:59 PM UTC
- Last modified: September 1, 2026 at 4:17:20 PM UTC
- CVSS v3.1: Base score 6.4, MEDIUM
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / Privileges / User interaction:
- Requires an authenticated user: description notes attackers must be authenticated (contributor-level access or above)
- Privileges required (CVSS): Low
- User interaction (CVSS): None
- Primary impact:
- Confidentiality: Low
- Integrity: Low
- Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
The plugin fails to sufficiently sanitize and escape user-supplied attributes for the wprm-call-to-action shortcode. Because those attributes are stored and later rendered in pages, an authenticated user with contributor-level access or higher can inject arbitrary web scripts that are persisted in the site content.
When a page containing the injected shortcode is loaded by another user, the injected script executes in the context of the site. The description identifies the shortcode name explicitly; no other functions or REST endpoints are named in the provided data.
The practical impact is limited to the ability to run script in page contexts where the shortcode is displayed. The CVSS data indicates confidentiality and integrity impacts are low and availability is not affected.
How This Could Impact Your Website
Imagine a small editorial team where a contributor or external contractor can create or edit recipe posts that use the plugin shortcode. An attacker with contributor access could inject a script into a recipe post. When an editor or site owner views that post, the script could run and expose data visible on that page or perform actions available to the viewing user within the page context.
Realistic consequences include exposure of internal user email addresses or other content present on pages, and an increased risk of targeted phishing or social engineering against staff whose information is exposed. The impact aligns with the CVSS rating of limited confidentiality and integrity impact rather than full site compromise.
If you are unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor-level accounts.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins from your site.
- Monitor site activity and logs for unusual behavior or unexpected content changes.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
