{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2025-14385", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "state": "PUBLISHED", "assignerShortName": "Wordfence", "dateReserved": "2025-12-09T19:43:33.393Z", "datePublished": "2025-12-17T04:31:31.692Z", "dateUpdated": "2026-04-08T17:29:59.216Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:59.216Z"}, "affected": [{"vendor": "brechtvds", "product": "WP Recipe Maker", "versions": [{"version": "0", "status": "affected", "lessThanOrEqual": "10.2.3", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 10.2.3 due to insufficient input sanitization and output escaping on user-supplied attributes in the wprm-recipe-roundup-item shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "title": "WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6030712-ae4f-4cdb-a500-dff689947ff3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php#L244"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php#L372"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/shortcodes/recipe/class-wprm-sc-name.php#L83"}, {"url": "https://plugins.trac.wordpress.org/changeset/3419784/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php"}], "problemTypes": [{"descriptions": [{"lang": "en", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "cweId": "CWE-79", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"version": "3.1", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "baseScore": 6.4, "baseSeverity": "MEDIUM"}}], "credits": [{"lang": "en", "type": "finder", "value": "Abhinav Jaswal"}], "timeline": [{"time": "2025-12-09T19:58:57.000Z", "lang": "en", "value": "Vendor Notified"}, {"time": "2025-12-16T15:58:59.000Z", "lang": "en", "value": "Disclosed"}]}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2025-12-17T19:27:48.527676Z", "id": "CVE-2025-14385", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T19:28:02.258Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2025-14385", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2025-12-17T19:27:48.527676Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-12-17T19:27:56.487Z"}}], "cna": {"title": "WP Recipe Maker <= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode", "credits": [{"lang": "en", "type": "finder", "value": "Abhinav Jaswal"}], "metrics": [{"cvssV3_1": {"version": "3.1", "baseScore": 6.4, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N"}}], "affected": [{"vendor": "brechtvds", "product": "WP Recipe Maker", "versions": [{"status": "affected", "version": "0", "versionType": "semver", "lessThanOrEqual": "10.2.3"}], "defaultStatus": "unaffected"}], "timeline": [{"lang": "en", "time": "2025-12-09T19:58:57.000Z", "value": "Vendor Notified"}, {"lang": "en", "time": "2025-12-16T15:58:59.000Z", "value": "Disclosed"}], "references": [{"url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6030712-ae4f-4cdb-a500-dff689947ff3?source=cve"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php#L244"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php#L372"}, {"url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/shortcodes/recipe/class-wprm-sc-name.php#L83"}, {"url": "https://plugins.trac.wordpress.org/changeset/3419784/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php"}], "descriptions": [{"lang": "en", "value": "The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 10.2.3 due to insufficient input sanitization and output escaping on user-supplied attributes in the wprm-recipe-roundup-item shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "shortName": "Wordfence", "dateUpdated": "2026-04-08T17:29:59.216Z"}}}, "cveMetadata": {"cveId": "CVE-2025-14385", "state": "PUBLISHED", "dateUpdated": "2026-04-08T17:29:59.216Z", "dateReserved": "2025-12-09T19:43:33.393Z", "assignerOrgId": "b15e7b5b-3da4-40ae-a43c-f7aa60e62599", "datePublished": "2025-12-17T04:31:31.692Z", "assignerShortName": "Wordfence"}, "dataVersion": "5.2"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "The WP Recipe Maker plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 10.2.3 due to insufficient input sanitization and output escaping on user-supplied attributes in the wprm-recipe-roundup-item shortcode. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page."}], "id": "CVE-2025-14385", "lastModified": "2026-04-15T00:35:42.020", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.4, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "LOW", "scope": "CHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.1, "impactScore": 2.7, "source": "security@wordfence.com", "type": "Secondary"}]}, "published": "2025-12-17T05:16:11.363", "references": [{"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php#L244"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php#L372"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/browser/wp-recipe-maker/trunk/includes/public/shortcodes/recipe/class-wprm-sc-name.php#L83"}, {"source": "security@wordfence.com", "url": "https://plugins.trac.wordpress.org/changeset/3419784/wp-recipe-maker/trunk/includes/public/class-wprm-recipe-roundup.php"}, {"source": "security@wordfence.com", "url": "https://www.wordfence.com/threat-intel/vulnerabilities/id/e6030712-ae4f-4cdb-a500-dff689947ff3?source=cve"}], "sourceIdentifier": "security@wordfence.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security@wordfence.com", "type": "Secondary"}]}

{}

{"analysis": {"en": {"generated_at": "2026-04-20T21:23:27.950144+00:00", "value": {"mitigation_remediation": ["Update WP Recipe Maker to version 10.2.4 or later.", "If an update cannot be performed immediately, remove or disable the wprm\u2011recipe\u2011roundup\u2011item shortcode on public pages or restrict Contributor role capabilities that allow editing or adding recipes.", "Implement or enforce server\u2011side sanitization and escaping for the 'name' attribute before rendering shortcodes, ensuring no executable scripts can be stored or displayed."], "summary": {"action": "Immediate Patch", "impact": "Stored Cross-Site Scripting"}, "threat_synthesis": {"affected_systems": "WordPress sites running the WP Recipe Maker plugin version 10.2.3 or earlier are affected. The vulnerability exists in all releases up to and including 10.2.3 of the plugin.", "description_and_impact": "The WP Recipe Maker plugin is vulnerable to a stored cross\u2011site scripting flaw via the 'name' attribute in the wprm\u2011recipe\u2011roundup\u2011item shortcode. This weakness arises from insufficient input sanitization and output escaping for user\u2011supplied attributes. An attacker with Contributor access can embed arbitrary JavaScript that will execute in the browsers of any user who views a page containing the contaminated shortcode. The resulting attack can lead to session hijacking, credential theft, defacement or the execution of malicious code within the site context. The flaw is classified as CWE\u201179.", "risk_and_exploitability": "The CVSS score of 6.4 indicates a moderate severity. The EPSS score of less than 1% signals a very low probability of exploitation in the wild, and the vulnerability is not listed in CISA KEV. Exploitation requires an authenticated attacker who holds Contributor or higher privileges on the WordPress installation, and the attacker must be able to insert content via the recipe roundup shortcode."}}}}, "created": "2025-12-17T14:28:37.635441+00:00", "updated": "2026-04-20T21:30:18.575817+00:00", "vendors": ["wordpress", "wordpress$PRODUCT$wordpress"]}