WP Recipe Maker, CVE-2026-86601

CVE, Research URL: CVE-2026-86601
Home page URL: Security reports for WP Recipe Maker
Application: WP Recipe Maker
Published on: Sep 23, 2026
Research Description: The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
Affected versions: max 10.8.2.
Status: vulnerable