The WP Recipe Maker plugin contains a stored cross‑site scripting flaw in the Roundup Recipe Name field. Because the input is neither sanitized nor properly escaped, attackers with Contributor‑level or higher privileges can place arbitrary JavaScript in recipe pages. When a user opens the affected page, the injected script runs in the victim’s browser, enabling credential theft, session hijacking, or other client‑side attacks. The vulnerability directly compromises the integrity of web content and the confidentiality of user sessions.

All installations of WP Recipe Maker by brechtvds up to and including version 9.8.0 are affected. The flaw exists in every release within that range of the plugin.

With a CVSS score of 6.4, the vulnerability is rated medium severity. The EPSS score of <1% indicates a very low probability of exploitation in the wild at this time, and the issue is not listed in the CISA KEV catalog. However, the requirement for authenticated Contributor access means that anyone with those privileges can execute the XSS payload, so site administrators must assess whether such credentials are granted broadly.