CVE-2024-1571: WP Recipe Maker <= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed
The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Video Embed parameter in all versions up to, and including, 9.2.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with access to the recipe dashboard (which is administrator-only by default but can be assigned to arbitrary capabilities), to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1571?
CVE-2024-1571 has a severity rating that indicates it could allow attackers to execute stored cross-site scripting attacks.
How do I fix CVE-2024-1571?
To fix CVE-2024-1571, update the WP Recipe Maker plugin to version 9.3.0 or later to ensure proper input sanitization.
Who is affected by CVE-2024-1571?
CVE-2024-1571 affects all versions of the WP Recipe Maker plugin up to and including version 9.2.1.
What type of vulnerability is CVE-2024-1571?
CVE-2024-1571 is classified as a Stored Cross-Site Scripting (XSS) vulnerability.
Can authenticated users exploit CVE-2024-1571?
Yes, authenticated attackers with access to the recipe data can exploit CVE-2024-1571 due to insufficient sanitization.