CVE-2024-1571: 
WordPress vulnerability analysis and mitigation

The WP Recipe Maker plugin for WordPress contains a Stored Cross-Site Scripting vulnerability (CVE-2024-1571) in versions up to and including 9.2.1. The vulnerability exists in the Video Embed parameter due to insufficient input sanitization and output escaping (NVD).

The vulnerability allows authenticated attackers with access to the recipe dashboard to inject arbitrary web scripts that execute when users access the injected page. The recipe dashboard is administrator-only by default but can be assigned to arbitrary capabilities. The vulnerability has been assigned a CVSS v3.1 base score of 4.4 (Medium) with the vector string CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N (NVD).

When successfully exploited, this vulnerability allows attackers to inject malicious web scripts that execute in users' browsers when they visit affected pages. This could potentially lead to theft of sensitive information or manipulation of page content (NVD).

The vulnerability requires an authenticated attacker with access to the recipe dashboard functionality. While the dashboard is restricted to administrators by default, the capability can be assigned to other user roles, potentially increasing the attack surface (NVD).

Users should update to a version newer than 9.2.1 of the WP Recipe Maker plugin to address this vulnerability (NVD).