Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
15 results
Oct 18, 2026Tasty Recipes Lite: Does not correctly check user capabilitiesCVE-2026-110026 · WordPress plugins & themes · reported by WPScanMedium 4.9
The Tasty Recipes Lite WordPress plugin before 1.2.11 does not correctly check user capabilities when creating, renaming and deleting taxonomy terms, allowing users with a role as low as Contributor to add, rename and permanently delete terms in any taxonomy on the site, including categories, tags and navigation menus.
- Product
- Tasty Recipes Lite
- Fixed in
- 1.2.11
- What to do
- Update Tasty Recipes Lite to 1.2.11 or newer.
Jul 16, 2026Delicious Recipes: Stored Cross-Site ScriptingCVE-2026-15099 · WordPress plugins & themes · reported by WordfenceMedium 6.4
The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrap_direction_text() function, which interpolates the user-supplied href value from nested link nodes ($node['props']['href']) directly into an anchor tag via sprintf() at line 1627 without esc_url() or any URL scheme validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts (including javascript: URIs) in pages that will execute whenever a user (such as an editor or administrator previewing the pending post) accesses an injected page and clicks the malicious link.
- Product
- Delicious Recipes
- Affected
- up to 1.10.2
- What to do
- Affects up to 1.10.2. Update Delicious Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jun 26, 2026Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.CVE-2026-57663 · WordPress plugins & themes · reported by PatchstackHigh 8.5
Contributor SQL Injection in Recipe Maker For Your Food Blog from Zip Recipes <= 8.2.7 versions.
- What to do
- Update the plugin to the newest version.
Dec 31, 2025Tasty Recipes Lite: Missing AuthorizationCVE-2025-62132 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through <= 1.1.5.
- Product
- Tasty Recipes Lite
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Tasty Recipes Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2025Tasty Recipes Lite: Missing AuthorizationCVE-2025-62131 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in Strategy11 Team Tasty Recipes Lite tasty-recipes-lite allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Tasty Recipes Lite: from n/a through <= 1.1.5.
- Product
- Tasty Recipes Lite
- Affected
- up to 1.1.5
- What to do
- Affects up to 1.1.5. Update Tasty Recipes Lite to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 1, 2025WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes): Arbitrary file uploads when importing recipesCVE-2025-11755 · WordPress plugins & themes · reported by WordfenceHigh 8.8
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file uploads when importing recipes via CSV in all versions up to, and including, 1.9.0. This flaw allows an attacker with at least Contributor-level permissions to upload a malicious PHP file by providing a remote URL during a recipe import process, leading to Remote Code Execution (RCE).
- Product
- WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
- Affected
- up to 1.9.0
- What to do
- Affects up to 1.9.0. Update WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgwordfence.com
Jun 20, 2025Recipes manager - WPH: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-50011 · WordPress plugins & themes · reported by PatchstackMedium 5.9
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Félix Martínez Recipes manager - WPH allows Stored XSS. This issue affects Recipes manager - WPH: from n/a through 1.0.4.
- Product
- Recipes manager - WPH
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update Recipes manager - WPH to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 9, 2025SEO, Nutrition and Print for Recipes by Edamam: Cross-Site Request Forgery (CSRF)CVE-2025-32555 · WordPress plugins & themes · reported by PatchstackHigh 7.1
Cross-Site Request Forgery (CSRF) vulnerability in Edamam SEO, Nutrition and Print for Recipes by Edamam seo-nutrition-and-print-for-recipes-by-edamam allows Stored XSS.This issue affects SEO, Nutrition and Print for Recipes by Edamam: from n/a through <= 3.3.
- Product
- SEO, Nutrition and Print for Recipes by Edamam
- Affected
- up to 3.3
- What to do
- Affects up to 3.3. Update SEO, Nutrition and Print for Recipes by Edamam to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Apr 1, 2025Boo Recipes: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')CVE-2025-31759 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in BooSpot Boo Recipes boo-recipes allows Stored XSS.This issue affects Boo Recipes: from n/a through <= 2.4.1.
- Product
- Boo Recipes
- Affected
- up to 2.4.1
- What to do
- Affects up to 2.4.1. Update Boo Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Mar 24, 2025Yummly Rich Recipes: Cross-Site Request Forgery (CSRF)CVE-2025-30549 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Yummly Yummly Rich Recipes yummly-rich-recipes allows Cross Site Request Forgery.This issue affects Yummly Rich Recipes: from n/a through <= 4.2.
- Product
- Yummly Rich Recipes
- Affected
- up to 4.2
- What to do
- Affects up to 4.2. Update Yummly Rich Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Sep 11, 2024WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes): Arbitrary file movement and readingCVE-2024-7626 · WordPress plugins & themes · reported by WordfenceHigh 8.1
The WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in the save_edit_profile_details() function in all versions up to, and including, 1.6.9. This makes it possible for authenticated attackers, with subscriber-level access and above, to move arbitrary files on the server, which can easily lead to remote code execution when the right file is moved (such as wp-config.php). This can also lead to the reading of arbitrary files that may contain sensitive information like wp-config.php.
- Product
- WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes)
- Affected
- up to 1.6.9
- What to do
- Affects up to 1.6.9. Update WP Delicious – Recipe Plugin for Food Bloggers (formerly Delicious Recipes) to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Aug 29, 2024Delicious Recipes – WordPress Recipe: Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')CVE-2024-43935 · WordPress plugins & themes · reported by PatchstackMedium 6.5
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Delicious Delicious Recipes – WordPress Recipe Plugin allows Stored XSS.This issue affects Delicious Recipes – WordPress Recipe Plugin: from n/a through 1.6.7.
- Product
- Delicious Recipes – WordPress Recipe
- Affected
- up to 1.6.7
- What to do
- Affects up to 1.6.7. Update Delicious Recipes – WordPress Recipe to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 31, 2023Recipe Maker For Your Food Blog from Zip Recipes: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')CVE-2023-52180 · WordPress plugins & themes · reported by PatchstackHigh 7.6
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes.This issue affects Recipe Maker For Your Food Blog from Zip Recipes: from n/a through 8.1.0.
- Product
- Recipe Maker For Your Food Blog from Zip Recipes
- Affected
- up to 8.1.0
- What to do
- Affects up to 8.1.0. Update Recipe Maker For Your Food Blog from Zip Recipes to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Jul 17, 2023Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.7 versions.CVE-2023-35089 · WordPress plugins & themes · reported by PatchstackMedium 4.3
Cross-Site Request Forgery (CSRF) vulnerability in Really Simple Plugins Recipe Maker For Your Food Blog from Zip Recipes plugin <= 8.0.7 versions.
- Fixed in
- 8.0.8
- What to do
- Update the plugin to 8.0.8 or newer.
Full record and what to do →NVD recordpatchstack.compatchstack.com
Oct 10, 2016Reflected XSS in wordpress plugin recipes-writer v1.0.4CVE-2016-1000147 · WordPress plugins & themes · reported by MITREMedium 6.1
Reflected XSS in wordpress plugin recipes-writer v1.0.4
- Affected
- up to 1.0.4
- What to do
- Affects up to 1.0.4. Update the plugin to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordsecurityfocus.comvapidlabs.com
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.