The WP Recipe Maker plugin has an improper neutralization of script‑related HTML tags, creating a basic cross‑site scripting flaw that allows malicious JavaScript to be injected into pages that display plugin content. The primary impact is client‑side script execution in the browsers of visitors to the affected site; the description does not mention authentication bypass, privilege escalation, or data theft, so the damage is limited to the immediate rendering context.

WordPress sites that include the Brecht WP Recipe Maker plugin at any version prior to 10.1.0 are potentially vulnerable. The flaw affects all installations where the plugin’s content is rendered on public pages.

The CVSS score of 5.3 indicates moderate severity, while the EPSS score of <1% suggests a low probability of exploitation at this time. The CVE is not listed in the CISA KEV catalog. The attack vector is inferred to be client‑side: an attacker must be able to inject or alter plugin content that is then displayed to other users. The description does not confirm whether authentication is required to insert content, so the potential for exploitation depends on the site’s configuration and user permissions.