{"id":"CVE-2026-119489","kind":"vulnerability","aliases":["CVE-2026-119489"],"related":[],"title":"WP Recipe Maker: stored cross-site scripting through 10.9.1 lets attackers run scripts","description":"Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Bootstrapped Ventures WP Recipe Maker wp-recipe-maker allows Stored XSS.This issue affects WP Recipe Maker: from n/a through 10.9.1.","summary":"WP Recipe Maker, a WordPress recipe plugin by Bootstrapped Ventures, has a stored cross-site scripting flaw in versions through 10.9.1. An attacker who can submit content stored by the plugin can run scripts in the browsers of people who view that content.","severity":"medium","cvss":6.5,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["package","wordpress","wp-recipe-maker"],"not_affected_if":["plugin-not-installed"],"how_to_check":"- Check the installed WP Recipe Maker version in the WordPress admin Plugins page.\n- Confirm whether the installed version is `10.9.1` or earlier.","fix":null,"status":"open","published_at":"2026-11-07T09:17:12+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","triaged_at":"2026-11-07T09:47:51+00:00","updated_at":"2026-11-07T09:47:51+00:00","category":"package","confidence":0.5,"triage":{"at":"2026-11-07T09:47:51Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"WP Recipe Maker: stored cross-site scripting through 10.9.1 lets attackers run scripts","impact":"medium","summary":"WP Recipe Maker, a WordPress recipe plugin by Bootstrapped Ventures, has a stored cross-site scripting flaw in versions through 10.9.1. An attacker who can submit content stored by the plugin can run scripts in the browsers of people who view that content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","wp-recipe-maker"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Scripts run in visitors' browsers and can steal session data","analyst_note":"Check the vendor advisory or the NVD entry for the fixed version and the role required to inject the stored content.","how_to_check":"- Check the installed WP Recipe Maker version in the WordPress admin Plugins page.\n- Confirm whether the installed version is `10.9.1` or earlier.","plain_action":"","needs_analyst":true,"not_affected_if":["plugin-not-installed"],"who_is_affected":"Sites running WP Recipe Maker at version 10.9.1 or earlier are in the stated range. The sources do not say which user roles can submit the stored content, so whether anonymous visitors can trigger it is unknown.","user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000684,"input_tokens":4235,"output_tokens":521,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119489':17A,20A '-2026':16A,19A '10.9.1':10A,48B,105C 'affect':98C 'allow':94C 'attack':12A,50B 'bootstrap':35B,85C 'browser':64B 'content':54B,70B 'cross':6A,41B,80C 'cross-sit':5A,40B,79C 'cve':15A,18A 'flaw':44B 'generat':78C 'improp':71C 'input':74C 'issu':97C 'let':11A 'maker':3A,26B,29B,89C,93C,101C 'n/a':103C 'neutral':72C 'packag':21B 'page':77C 'peopl':66B 'plugin':33B,58B 'recip':2A,25B,28B,32B,88C,92C,100C 'run':13A,60B 'script':8A,14A,43B,61B,82C 'site':7A,42B,81C 'store':4A,39B,55B,95C 'submit':53B 'ventur':36B,86C 'version':46B 'view':68B 'vulner':83C 'web':76C 'wordpress':22B,31B 'wp':1A,24B,27B,87C,91C,99C 'wp-recipe-mak':23B,90C 'xss.this':96C","nicknames":[],"mitigations":[],"who_affected":"Sites running WP Recipe Maker at version 10.9.1 or earlier are in the stated range. The sources do not say which user roles can submit the stored content, so whether anonymous visitors can trigger it is unknown.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","package","wordpress","wprecipemaker"],"campaign_type":null,"search_a":"'-119489':17A,20A '-2026':16A,19A '10.9.1':10A 'attack':12A 'cross':6A 'cross-sit':5A 'cve':15A,18A 'let':11A 'maker':3A 'recip':2A 'run':13A 'script':8A,14A 'site':7A 'store':4A 'wp':1A","search_b":"'10.9.1':48B 'attack':50B 'bootstrap':35B 'browser':64B 'content':54B,70B 'cross':41B 'cross-sit':40B 'flaw':44B 'maker':26B,29B 'packag':21B 'peopl':66B 'plugin':33B,58B 'recip':25B,28B,32B 'run':60B 'script':43B,61B 'site':42B 'store':39B,55B 'submit':53B 'ventur':36B 'version':46B 'view':68B 'wordpress':22B,31B 'wp':24B,27B 'wp-recipe-mak':23B","search_c":"'10.9.1':105C 'affect':98C 'allow':94C 'bootstrap':85C 'cross':80C 'cross-sit':79C 'generat':78C 'improp':71C 'input':74C 'issu':97C 'maker':89C,93C,101C 'n/a':103C 'neutral':72C 'page':77C 'recip':88C,92C,100C 'script':82C 'site':81C 'store':95C 'ventur':86C 'vulner':83C 'web':76C 'wp':87C,91C,99C 'wp-recipe-mak':90C 'xss.this':96C","first_public_at":"2026-11-07T09:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L","cvss_by":"audit@patchstack.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119489","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119489","severity":null,"published_at":"2026-11-07T09:17:12+00:00","modified_at":"2026-11-07T09:17:13+00:00","first_seen_at":"2026-11-07T09:46:24+00:00","fetched_at":"2026-11-07T09:46:24+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}