Wp Recipe Maker Premium
Monthly
Stored Cross-Site Scripting in WP Recipe Maker Premium for WordPress (all versions ≤ 10.5.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'wprm-call-to-action' shortcode's unsanitized attributes. Every subsequent visitor to an injected page executes the attacker's script in their browser, enabling session hijacking, credential harvesting, or privilege escalation to administrator. No public exploit code or CISA KEV listing has been identified at time of analysis.
Stored Cross-Site Scripting in WP Recipe Maker Premium for WordPress (all versions ≤ 10.5.0) allows authenticated attackers with contributor-level access to inject persistent JavaScript payloads via the 'wprm-call-to-action' shortcode's unsanitized attributes. Every subsequent visitor to an injected page executes the attacker's script in their browser, enabling session hijacking, credential harvesting, or privilege escalation to administrator. No public exploit code or CISA KEV listing has been identified at time of analysis.