CVE-2026-90884: WP Recipe Maker Plugin XSS Vulnerability

CVE-2026-90884 Overview

CVE-2026-90884 is a Stored Cross-Site Scripting (XSS) vulnerability in the WP Recipe Maker plugin for WordPress. The flaw affects all versions up to and including 10.8.1. The plugin fails to properly sanitize input and escape output for the notes parameter. Authenticated users with Contributor-level access or higher can inject arbitrary JavaScript into recipe content. The injected scripts execute in the browser of any visitor who loads the affected page. This vulnerability is categorized under [CWE-79] (Improper Neutralization of Input During Web Page Generation).

Critical Impact
Authenticated contributors can persist malicious JavaScript in WordPress pages, enabling session theft, administrative account compromise, and drive-by redirects against site visitors and administrators.

Affected Products

WordPress plugin: WP Recipe Maker (all versions ≤ 10.8.1)
WordPress sites permitting Contributor-level accounts or above with the plugin active
Any WordPress installation loading recipe pages containing the injected notes field

Discovery Timeline

2026-09-18 - CVE-2026-90884 published to the National Vulnerability Database
2026-09-18 - Last updated in NVD database

Technical Details for CVE-2026-90884

Vulnerability Analysis

The WP Recipe Maker plugin accepts recipe metadata from authenticated users through several fields, including the notes parameter. The plugin stores this input in the database and later renders it back on public-facing recipe pages. Because the plugin does not enforce sufficient input sanitization on write, nor proper output escaping on render, HTML and JavaScript submitted through notes survive intact through the storage and display pipeline. When any user views a page containing an injected recipe, the browser parses the attacker-supplied markup and executes the embedded script in the site's origin.

The scope change indicated by the CVSS vector reflects that a Contributor-level author can influence content viewed by higher-privileged users, including administrators. This creates a viable path for privilege escalation through session hijacking or forced administrative actions.

Root Cause

The root cause is missing neutralization of user-controlled input in the notes field. Neither server-side sanitization filters (such as WordPress wp_kses with a restrictive allowlist) nor context-appropriate output escaping (such as esc_html or esc_attr) are applied before the value is written to the page. As a result, script tags and event-handler attributes are preserved verbatim in the rendered HTML.

Attack Vector

Exploitation requires an authenticated account with Contributor role or higher and one victim interaction to load an affected page. The attacker creates or edits a recipe, embeds a payload such as a <script> block or an onerror-bearing image tag inside the notes field, and submits the content. When an administrator, editor, or site visitor later opens the page, the payload executes with the privileges of that user's browsing session. Typical follow-on actions include exfiltrating session cookies, creating rogue administrator accounts through the REST API, or serving malicious redirects.

No public proof-of-concept exploit code is available for this vulnerability. Technical details are described in the Wordfence Vulnerability Analysis and the WordPress Trac Changeset Update.

Detection Methods for CVE-2026-90884

Indicators of Compromise

Recipe records where the notes column in the wp_postmeta or plugin-specific tables contains <script, onerror=, onload=, javascript:, or base64-encoded payloads.
Unexpected creation of WordPress administrator accounts shortly after a contributor edits a recipe.
Outbound HTTP requests from administrator browsers to unfamiliar domains immediately after loading a recipe page.
New or modified posts authored by Contributor-level accounts containing unusual HTML markup in recipe fields.

Detection Strategies

Query the WordPress database for post meta and plugin tables to identify recipe notes containing HTML tags or JavaScript event handlers.
Enable and review WordPress audit logs for recipe edits performed by low-privilege users followed by administrator activity on the same URLs.
Deploy a web application firewall rule that flags POST requests to WP Recipe Maker endpoints containing script markup in the notes parameter.
Monitor browser Content Security Policy (CSP) violation reports for inline script executions on /recipe/ or plugin-rendered URLs.

Monitoring Recommendations

Alert on WordPress user role changes and new administrator account creation events, especially those originating from authenticated sessions on recipe pages.
Track REST API calls to /wp-json/wp/v2/users and /wp-json/wp/v2/posts that follow visits to recipe pages within a short time window.
Aggregate WordPress access logs and correlate contributor edits with subsequent administrator page loads to identify potential exploitation chains.

How to Mitigate CVE-2026-90884

Immediate Actions Required

Update WP Recipe Maker to the version published in WordPress Trac changeset 3699793, which supersedes 10.8.1.
Audit all recipes created or modified by Contributor-level and Author-level users for embedded HTML or JavaScript in the notes field.
Review WordPress user accounts and revoke unnecessary Contributor privileges until patching is complete.
Rotate credentials and session tokens for administrator accounts that may have viewed compromised recipe pages.

Patch Information

The vendor fix is available through the plugin update referenced in the WordPress Trac Changeset Update. Site administrators should update WP Recipe Maker to a version later than 10.8.1 through the WordPress plugin dashboard or by deploying the updated plugin package directly. Additional analysis is documented in the Wordfence Vulnerability Analysis.

Workarounds

Temporarily deactivate the WP Recipe Maker plugin until the patched version is deployed.
Restrict recipe creation and editing to trusted Editor or Administrator accounts by removing the capability from the Contributor role.
Deploy a Content Security Policy that disallows inline scripts on public recipe pages to blunt payload execution.
Configure a web application firewall to block POST bodies that contain <script or JavaScript event handlers in the notes parameter.

bash

# Configuration example: remove recipe editing from the Contributor role via WP-CLI
wp cap remove contributor edit_posts publish_posts
wp plugin update wp-recipe-maker
wp plugin list --name=wp-recipe-maker --fields=name,status,version