PT-2024-18141 · WordPress · Wp Recipe Maker

Published 2024-04-09 · Updated 2025-02-27 · CVE-2024-1571

Positive Technologies (AI Summary)

CVSS v3.1

4.8

Medium

Base vector

AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions WP Recipe Maker plugin for WordPress versions up to and including 9.2.1

Description The issue arises from insufficient input sanitization and output escaping in the Video Embed parameter, allowing authenticated attackers to inject arbitrary web scripts in pages. This can be executed whenever a user accesses an injected page, potentially affecting users who visit the compromised pages.

Recommendations For WP Recipe Maker plugin for WordPress versions up to and including 9.2.1, update to a version later than 9.2.1 to resolve the issue. As a temporary workaround, consider restricting access to the recipe dashboard to only necessary users and avoiding the use of the Video Embed parameter until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-1571

Affected Products

Wp Recipe Maker

References · 5

• https://osv.dev/vulnerability/CVE-2024-1571 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-1571 · Security Note
• https://plugins.trac.wordpress.org/changeset/3046892/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-sanitizer.php · Patch
• https://t.me/cvenotify/112634 · Telegram Post
• https://wordfence.com/threat-intel/vulnerabilities/id/6c098b35-606e-4dde-8683-4c90f518ddb5?source=cve · Note