CVE-2026-119489 · Package
NO FIX YET
WP Recipe Maker, a WordPress recipe plugin by Bootstrapped Ventures, has a stored cross-site scripting flaw in versions through 10.9.1. An attacker who can submit content stored by the plugin can run scripts in the browsers of people who view that content.
first public Nov 7, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running WP Recipe Maker at version 10.9.1 or earlier are in the stated range. The sources do not say which user roles can submit the stored content, so whether anonymous visitors can trigger it is unknown.
Not affected if plugin-not-installed
Who cares wordpress, wp-recipe-maker
10.9.1 or earlier.No fix yet, per the sources.
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped Ventures WP Recipe Maker wp-recipe-maker allows Stored XSS.This issue affects WP Recipe Maker: from n/a through 10.9.1.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.