PLUGIN SECURITY
Is WP Recipe Maker safe?
Known vulnerabilities, PHP compatibility and safer alternatives for the WP Recipe Maker WordPress plugin — checked against WP Clinic's local security database.
What this plugin does
- Slug:
wp-recipe-maker
Maintenance status
Known vulnerabilities
29 known CVEs on file for WP Recipe Maker.
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-122060 | WP Recipe Maker [wp-recipe-maker] < 10.9.2 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 5.3 | < 10.9.2 | 10.9.2 | 2026-11-07 | — |
| CVE-2026-119489 | WP Recipe Maker [wp-recipe-maker] < 10.9.2 | — | Medium 6.5 | < 10.9.2 | 10.9.2 | 2026-11-05 | — |
| CVE-2026-86602 | WP Recipe Maker [wp-recipe-maker] >= 10.3.0 - < 10.8.2 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | 10.3.0–10.8.2 | 10.8.2 | 2026-09-21 | — |
| CVE-2026-86601 | WP Recipe Maker [wp-recipe-maker] < 10.8.2 | Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') | Medium 6.5 | < 10.8.2 | 10.8.2 | 2026-09-21 | — |
| CVE-2026-86608 | WP Recipe Maker [wp-recipe-maker] >= 9.8.0 - < 10.8.2 | Uncontrolled Resource Consumption | Unknown | 9.8.0–10.8.2 | 10.8.2 | 2026-09-21 | — |
| CVE-2026-86603 | WP Recipe Maker [wp-recipe-maker] < 10.8.2 | Exposure of Sensitive Information to an Unauthorized Actor | Unknown | < 10.8.2 | 10.8.2 | 2026-09-21 | — |
| CVE-2026-89274 | WP Recipe Maker [wp-recipe-maker] < 10.8.2 | Improper Control of Generation of Code ('Code Injection') | Critical 9.1 | < 10.8.2 | 10.8.2 | 2026-09-17 | — |
| CVE-2026-90884 | WP Recipe Maker [wp-recipe-maker] < 10.8.2 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 10.8.2 | 10.8.2 | 2026-09-08 | — |
+ 23 more known vulnerabilities
| CVE | Vulnerability | Type | Severity | Affected | Fixed in | Published | Status |
|---|---|---|---|---|---|---|---|
| CVE-2026-75905 | WP Recipe Maker [wp-recipe-maker] < 10.8.1 | Missing Authorization | Medium 4.3 | < 10.8.1 | 10.8.1 | 2026-02-26 | — |
| CVE-2025-14742 | WP Recipe Maker [wp-recipe-maker] < 10.3.0 | Authorization Bypass Through User-Controlled Key | Medium 4.3 | < 10.6.1 | 10.6.1 | 2026-02-24 | — |
| CVE-2026-24357 | WP Recipe Maker [wp-recipe-maker] < 10.3.0 | Missing Authorization | Medium 4.3 | < 10.3.0 | 10.3.0 | 2026-01-22 | — |
| CVE-2025-14385 | WP Recipe Maker [wp-recipe-maker] < 10.2.4 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 10.2.4 | 10.2.4 | 2025-12-16 | — |
| CVE-2025-15527 | WP Recipe Maker [wp-recipe-maker] < 10.2.3 | Exposure of Sensitive Information to an Unauthorized Actor | Medium 4.3 | < 10.2.3 | 10.2.3 | 2025-12-11 | — |
| CVE-2025-62897 | WP Recipe Maker [wp-recipe-maker] < 10.1.0 | Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) | Medium 5.3 | < 10.1.0 | 10.1.0 | 2025-09-26 | — |
| CVE-2024-9650 | WP Recipe Maker [wp-recipe-maker] < 9.7.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 9.7.0 | 9.7.0 | 2024-10-23 | — |
| CVE-2024-0383 | WP Recipe Maker [wp-recipe-maker] < 9.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 9.1.1 | 9.1.1 | 2024-06-18 | — |
| CVE-2024-3490 | WP Recipe Maker [wp-recipe-maker] < 9.4.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 9.4.0 | 9.4.0 | 2024-05-01 | — |
| CVE-2024-1571 | WP Recipe Maker [wp-recipe-maker] < 9.3.0 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 4.8 | < 9.3.0 | 9.3.0 | 2024-03-14 | — |
| CVE-2024-1206 | WP Recipe Maker [wp-recipe-maker] < 9.2.0 | Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') | High 8.8 | < 9.2.0 | 9.2.0 | 2024-02-07 | — |
| CVE-2024-0382 | WP Recipe Maker [wp-recipe-maker] < 9.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 9.1.1 | 9.1.1 | 2024-01-17 | — |
| CVE-2024-0380 | WP Recipe Maker [wp-recipe-maker] < 9.1.1 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | Medium 4.3 | < 9.1.1 | 9.1.1 | 2024-01-17 | — |
| CVE-2024-0384 | WP Recipe Maker [wp-recipe-maker] < 9.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 9.1.1 | 9.1.1 | 2024-01-17 | — |
| CVE-2023-6970 | WP Recipe Maker [wp-recipe-maker] < 9.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.1 | < 9.1.1 | 9.1.1 | 2024-01-17 | — |
| CVE-2024-0381 | WP Recipe Maker [wp-recipe-maker] < 9.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 9.1.1 | 9.1.1 | 2024-01-17 | — |
| CVE-2023-6958 | WP Recipe Maker [wp-recipe-maker] < 9.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 9.1.1 | 9.1.1 | 2024-01-17 | — |
| CVE-2024-0255 | WP Recipe Maker [wp-recipe-maker] < 9.1.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 9.1.1 | 9.1.1 | 2024-01-17 | — |
| CVE-2022-4468 | WP Recipe Maker [wp-recipe-maker] < 8.6.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 5.4 | < 8.6.1 | 8.6.1 | 2022-12-19 | — |
| — | WP Recipe Maker [wp-recipe-maker] < 9.8.1 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | Medium 6.4 | < 9.8.1 | 9.8.1 | 0000-00-00 | — |
| — | WP Recipe Maker [wp-recipe-maker] < 10.3.3 | — | Unknown | < 10.3.3 | 10.3.3 | 0000-00-00 | — |
| CVE-2025-1503 | WP Recipe Maker < 9.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting | — | Unknown | < 9.8.1 | 9.8.1 | — | — |
| CVE-2026-1558 | WP Recipe Maker < 10.3.3 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter | — | Unknown | < 10.3.3 | 10.3.3 | — | — |
How to fix it
Update this plugin to the latest release from wordpress.org — each CVE above lists the exact release that fixed it ("Fixed in") when one is on file.
This is the plugin's full known vulnerability history, not a scan of any specific installation — run a free scan of your own site to check your exact installed version.
Check your own WordPress site
Run a free passive scan now, or create a free account and install the WP Clinic plugin for a deep scan of your whole hosting account and AI-assisted repair.