CVE-2026-119489: WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability

Q: How can I determine whether my site is affected?

Check the installed WP Recipe Maker version. Versions through 10.9.1 are affected; the affected version range begins at an unspecified earlier version.

Q: What does the stored nature of this issue mean for triage?

Malicious input can be retained by the application and later rendered in web pages. Review content and plugin-managed data created by users for unexpected script content if you suspect exploitation.

Published Nov 7, 2026

Updated

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped Ventures WP Recipe Maker wp-recipe-maker allows Stored XSS.This issue affects WP Recipe Maker: from n/a through 10.9.1.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Bootstrapped Ventures WP Recipe Maker to a version that resolves this vulnerability.
Fixed in 10.9.2

Event History

Nov 7, 2026

CVE Published

via MITRE·08:55 AM

Data Sourced

via MITRE·08:55 AM

RemedyDescriptionSeverityWeakness

Data Sourced

via NVD·09:17 AM

DescriptionSeverityWeakness

Frequently Asked Questions

How can I determine whether my site is affected?

Check the installed WP Recipe Maker version. Versions through 10.9.1 are affected; the affected version range begins at an unspecified earlier version.

What does the stored nature of this issue mean for triage?

Malicious input can be retained by the application and later rendered in web pages. Review content and plugin-managed data created by users for unexpected script content if you suspect exploitation.

CVE-2026-119489: WordPress WP Recipe Maker plugin <= 10.9.1 - Cross Site Scripting (XSS) vulnerability

Remediation

Event History

Frequently Asked Questions

How can I determine whether my site is affected?

What does the stored nature of this issue mean for triage?

Company

Resources

Contact

Frequently Asked Questions

How can I determine whether my site is affected?

What does the stored nature of this issue mean for triage?