An improper neutralization of input is performed when the plugin builds web pages, allowing an attacker to store malicious JavaScript templates that are executed when users view a recipe. The stored XSS flaw means that injected scripts run in the browser context of anyone who visits the affected recipe, potentially enabling cookie theft, session hijacking, defacement or other client‑side attacks. The weakness is a classic input validation and output encoding failure, identified as CWE‑79.

WordPress sites that have installed the Bootstrapped Ventures WP Recipe Maker plugin, including all releases up through version 10.9.1. The vulnerability does not affect later releases; it applies to every installation of the plugin where users can submit recipe content prior to upgrade.

The CVSS score of 6.5 reflects a moderate severity for stored cross‑site scripting. Although EPSS data is unavailable, the lack of a high exploitation probability is offset by the fact that any user who can submit a recipe can insert malicious payloads, making the flaw readily exploitable in typical deployment contexts. The vulnerability is not currently listed in the CISA KEV catalog, but the impact on user sessions and potential data theft warrants immediate attention.