In WP Recipe Manager up to and including version 1.0.0, the Skill Level input field does not sanitize or escape user supplied data. This allows a logged‑in user with Contributor privileges or higher to store malicious JavaScript that is then rendered in recipe pages. When another user opens a recipe page containing the injected script, the code executes in the victim’s browser, potentially leaking session cookies, defacing the site, or performing other client‑side attacks. The flaw is a classic stored XSS (CWE‑79) that depends on authenticating to the site and creating or editing a recipe entry.

WordPress sites running the WP Recipe Manager plugin version 1.0.0 or earlier. The plugin is distributed under the tomiup:WP Recipe Manager CNA and the vulnerability is present in all releases up to 1.0.0 for any deployment, regardless of WordPress version.

The CVSS v3.1 score of 6.4 classifies the vulnerability as medium‑to‑high severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild at present. The flaw is not listed in the CISA KEV catalog. Exploitation requires an authenticated session with Contributor level or higher, and the attacker must create or edit a recipe to inject the payload. Once injected, the script runs automatically for any site visitor who views the affected recipe page.