CVE-2026-7877

Name of the Vulnerable Software and Affected Versions WP Recipe Maker Premium versions prior to 10.5.1

Description Stored Cross-Site Scripting occurs via the 'wprm-call-to-action' shortcode due to insufficient input sanitization and output escaping on user supplied attributes. Authenticated attackers with contributor-level access and above can inject arbitrary web scripts into pages, which execute when a user accesses the affected page.

Recommendations Update WP Recipe Maker Premium to version 10.5.1 or later.