CVE-2024-0380 is a CWE-22 path traversal vulnerability in the WP Recipe Maker plugin for WordPress, affecting all versions up to 9.1.0. The issue arises from improper limitation of pathname input via the 'icon' attribute used in shortcodes, allowing authenticated users with contributor or higher privileges to read SVG files on the server. This can be leveraged to perform cross-site scripting attacks by including malicious SVG content. The CVSS 3.1 base score is 5.4, reflecting a medium severity with network attack vector, low attack complexity, and requiring privileges but no user interaction.

An attacker with contributor-level access or above can exploit this vulnerability to read arbitrary SVG files on the server via directory traversal. This can lead to cross-site scripting (XSS) attacks, potentially compromising site users or administrators. There is no indication of impact on availability or integrity beyond the described information disclosure and XSS risk. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access carefully and consider disabling or removing the WP Recipe Maker plugin if possible. Monitor vendor channels for updates and apply patches promptly once released.