CVE-2022-4468: WP Recipe Maker < 8.6.1 - Contributor+ Stored XSS
The WP Recipe Maker WordPress plugin before 8.6.1 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admin.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2022-4468?
The severity of CVE-2022-4468 is medium with a CVSS score of 5.4.
What is CVE-2022-4468?
CVE-2022-4468 is a vulnerability in the WP Recipe Maker WordPress plugin before version 8.6.1 that allows Stored Cross-Site Scripting attacks.
How can the WP Recipe Maker plugin be exploited via CVE-2022-4468?
The vulnerability in the WP Recipe Maker plugin can be exploited by users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, enabling them to execute malicious scripts on the affected website.
What software versions are affected by CVE-2022-4468?
WP Recipe Maker plugin versions up to and excluding 8.6.1 are affected by CVE-2022-4468.
Is there a fix available for CVE-2022-4468?
Yes, updating the WP Recipe Maker plugin to version 8.6.1 or higher will fix the vulnerability.