CVE-2024-0382: WP Recipe Maker <= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header_tag
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode(s) in all versions up to, and including, 9.1.0 due to unrestricted use of the 'headertag' attribute. This makes it possible for authenticated attackers with contributor-level and above permissions to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-0382?
CVE-2024-0382 has been classified as a high severity vulnerability due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2024-0382?
To fix CVE-2024-0382, update the WP Recipe Maker plugin to version 9.1.1 or later which addresses the vulnerability.
Who is affected by CVE-2024-0382?
CVE-2024-0382 affects all versions of the WP Recipe Maker plugin for WordPress up to and including version 9.1.0.
What kind of attack can be executed using CVE-2024-0382?
CVE-2024-0382 allows authenticated attackers to perform stored cross-site scripting attacks by exploiting the 'header_tag' attribute in shortcodes.
Is user authentication required to exploit CVE-2024-0382?
Yes, CVE-2024-0382 requires authentication, as it can only be exploited by users with contributor-level access or higher.