The Recip.ly WordPress plugin contains an improper neutralization of input that allows an attacker to inject malicious scripts into webpages viewed by other users. This reflected cross‑site scripting flaw can cause arbitrary client‑side code execution, enabling session hijacking, credential theft, or defacement of visitor content. The weakness is a classic input‑validation problem identified as CWE‑79.

Affected systems are sites that have installed the Recip.ly plugin version 1.1.8 or earlier. The plugin is developed by craig.edmunds@gmail.com and is used within WordPress installations, potentially affecting many public websites that rely on the plugin for recipe management features.

The vulnerability carries a CVSS score of 7.1, indicating moderate‑high risk. The EPSS score is below 1 %, suggesting a low but non‑zero likelihood of exploitation at any given time. It is not listed in the CISA KEV catalog, so there are no known widespread exploits. Based on the description, it is inferred that attackers can exploit the flaw by crafting a malicious URL that includes suspicious query parameters; when a victim clicks the link, the script runs in the victim’s browser.