medium6.5
CVE-2026-86601
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metad…
Impact
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.
Affected products
| Product | Affected versions |
|---|---|
| WP Recipe Maker WordPress Plugin | before 10.8.2 |
Versions were read from the advisory text. No structured product data has been published for this record yet.