CVE-2026-7877: WP Recipe Maker Premium XSS Vulnerability

CVE-2026-7877 Overview

CVE-2026-7877 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker Premium plugin for WordPress. The flaw affects all versions up to and including 10.5.0. Attackers with contributor-level access or above can inject arbitrary JavaScript through user-supplied attributes of the wprm-call-to-action shortcode. The injected scripts execute in the browser of any visitor who accesses an affected page. The vulnerability is classified under CWE-79 and stems from insufficient input sanitization and output escaping on shortcode attributes.

Critical Impact
Authenticated contributors can persist malicious JavaScript in published pages, enabling session theft, redirection, and administrative account takeover when higher-privileged users view affected content.

Affected Products

WP Recipe Maker Premium plugin for WordPress, all versions ≤ 10.5.0
WordPress sites running the plugin with contributor-or-higher user registration enabled
Any front-end page rendering the wprm-call-to-action shortcode

Discovery Timeline

2026-09-01 - CVE-2026-7877 published to the National Vulnerability Database
2026-09-01 - Last updated in NVD

Technical Details for CVE-2026-7877

Vulnerability Analysis

The vulnerability resides in how the WP Recipe Maker Premium plugin processes attributes passed to the wprm-call-to-action shortcode. The plugin accepts user-supplied strings as shortcode parameters and renders them into HTML output without applying appropriate sanitization or escaping. As a result, an authenticated user with contributor-level permissions or higher can embed the shortcode with attributes containing JavaScript payloads. When the post or page is rendered, the payload executes in the browser of every visitor, including administrators.

Stored XSS via shortcode attributes is particularly effective on WordPress because contributor accounts frequently exist on multi-author sites and the injected content persists in the database. Consumption of the injected payload by an administrator can yield session hijack, forced privilege escalation, or backend content modification.

Root Cause

The root cause is missing input sanitization on incoming shortcode attribute values combined with missing output escaping when those values are placed into the rendered HTML. WordPress provides helper functions such as sanitize_text_field(), esc_attr(), and wp_kses_post() that should be applied to any user-controlled string emitted to the DOM. The affected shortcode handler in WP Recipe Maker Premium does not consistently apply these functions to the attributes it accepts.

Attack Vector

An attacker authenticates to the WordPress instance with a contributor, author, editor, or higher role. The attacker inserts the wprm-call-to-action shortcode into a draft post with an attribute value containing a JavaScript payload. When the post is published or previewed by a reviewer, the shortcode renders and the script executes in the reviewer's browser context. The vulnerability requires low attack complexity, network access, and low privileges. No user interaction beyond visiting the injected page is required.

See the Wordfence Vulnerability Report for additional technical detail.

Detection Methods for CVE-2026-7877

Indicators of Compromise

Presence of [wprm-call-to-action] shortcode instances in wp_posts content with attribute values containing <script>, javascript:, onerror=, onload=, or other event-handler strings
Unexpected outbound requests from visitor browsers to attacker-controlled domains originating from pages containing the shortcode
New administrator accounts or altered user roles created shortly after a contributor session accessed post-editing endpoints

Detection Strategies

Query the WordPress database for post content matching the wprm-call-to-action shortcode combined with suspicious attribute payloads
Review web server access logs for POST requests to /wp-admin/post.php and /wp-admin/admin-ajax.php from contributor accounts that were followed by administrator page views
Deploy a Content Security Policy (CSP) and monitor report-uri submissions for inline script violations on pages that render recipes or calls-to-action

Monitoring Recommendations

Alert on creation or modification of posts containing the affected shortcode by non-editor roles
Correlate contributor login events with subsequent administrator session anomalies such as unexpected role changes or plugin installations
Track outbound network telemetry from workstations used by editorial staff who preview contributor submissions

How to Mitigate CVE-2026-7877

Immediate Actions Required

Update WP Recipe Maker Premium to a version later than 10.5.0 as soon as the vendor publishes a patched release
Audit all contributor, author, and editor accounts and remove any that are inactive, unrecognized, or unnecessary
Search existing post content for the wprm-call-to-action shortcode and inspect attributes for injected script payloads

Patch Information

Refer to the WP Recipe Maker Changelog for the fixed release notes. Apply the vendor-supplied update through the WordPress plugin management interface or via wp-cli once the patched version is available. Verify the plugin version in wp-admin after applying the update.

Workarounds

Restrict the ability to use the wprm-call-to-action shortcode to trusted roles by filtering do_shortcode output or removing the shortcode registration until patched
Enforce a strict Content Security Policy that disallows inline scripts and unauthorized external script sources
Temporarily disable contributor and author self-registration and require editor review before any post preview occurs in an authenticated browser context

bash

# Example: check installed plugin version and search for suspicious shortcode use
wp plugin get wp-recipe-maker-premium --field=version
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%wprm-call-to-action%' AND (post_content LIKE '%<script%' OR post_content LIKE '%onerror=%' OR post_content LIKE '%javascript:%');"