CVE-2024-0381: WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag'
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of the 'tag' attribute in the wprm-recipe-name, wprm-recipe-date, and wprm-recipe-counter shortcodes in all versions up to, and including, 9.1.0. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0381?
CVE-2024-0381 has a severity level that indicates a risk of Stored Cross-Site Scripting for authenticated users.
How do I fix CVE-2024-0381?
To fix CVE-2024-0381, update the WP Recipe Maker plugin to version 9.2.0 or later.
Who is affected by CVE-2024-0381?
CVE-2024-0381 affects all versions of the WP Recipe Maker plugin up to and including version 9.1.0.
What is Stored Cross-Site Scripting in context of CVE-2024-0381?
Stored Cross-Site Scripting in CVE-2024-0381 allows attackers to inject malicious scripts via specific shortcode attributes.
Can CVE-2024-0381 be exploited remotely?
CVE-2024-0381 requires authentication, meaning only logged-in users can exploit the vulnerability.