Security Alert Summary
A stored cross-site scripting (XSS) vulnerability has been identified in the WP Recipe Maker plugin. An authenticated user with Contributor-level access or higher can supply a crafted value to the name parameter used by the wprm-recipe-roundup-item shortcode, which may result in arbitrary script execution in pages that display the injected content.
CVE Details
- CVE ID: CVE-2025-14385
- Affected component: WP Recipe Maker plugin for WordPress
- Affected versions: all versions up to, and including, 10.2.3
- Published: December 17, 2025 at 05:16:11 AM UTC
- Last modified: December 17, 2025 at 05:16:11 AM UTC
- CVSS v3.1: Base Score 6.4, MEDIUM —
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction: Privileges Required: LOW (Contributor-level and above), User Interaction: NONE
- Primary impact: Confidentiality: LOW; Integrity: LOW; Availability: NONE
- CWE / weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation)
Technical Details
This is a stored cross-site scripting issue caused by insufficient input sanitization and output escaping for user-supplied attributes used by the wprm-recipe-roundup-item shortcode. The plugin accepts a name parameter that is included in page output without adequate sanitization/escaping, allowing an authenticated user with Contributor-level access or higher to inject arbitrary HTML or JavaScript that will persist in the site content.
The problem is described in the plugin code paths referenced (for example: includes/public/class-wprm-recipe-roundup.php and includes/public/shortcodes/recipe/class-wprm-sc-name.php in the project repository). The injected script executes in the context of any visitor who views a page containing the injected shortcode output.
Impact is limited to what can be achieved via script execution in the browser of affected users. The vulnerability does not, by itself, indicate server-side code execution, but it can be used to steal data accessible to a victim’s browser session, modify displayed content, or carry out actions available to the victim within their session.
How This Could Impact Your Website
Consider a site with multiple roles: a site owner, an internal content editor, and an external contractor who contributes recipes. If a contractor or contributor inserts a crafted name value via the shortcode, that injected script could run when an editor, administrator, or regular visitor views the page. Practical consequences include exposure of information displayed on the page, theft of tokens or session data accessible in the browser, or scripts that alter content seen by other users.
Examples of realistic outcomes include targeted phishing or social engineering campaigns using content altered by the injected script, and limited disclosure of data visible to the affected page (for example, email addresses shown on that page). The confidentiality and integrity impacts are assessed as LOW in the CVSS data; this reflects targeted, browser-based effects rather than automatic site-wide takeover.
If you’re unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially Contributor or higher where not required.
- Enforce strong passwords and enable two-factor authentication for Editors and Administrators.
- Remove unused or unmaintained plugins.
- Monitor site activity and logs for unusual changes to content or unexpected user behavior.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php#L244
- https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php#L372
- https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/shortcodes/recipe/class-wprm-sc-name.php#L83
- https://plugins.trac.wordpress.org/changeset/3419784/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php
- https://www.wordfence.com/threat-intel/vulnerabilities/id/e6030712-ae4f-4cdb-a500-dff689947ff3?source=cve
