CVE-2024-0382 is a stored cross-site scripting vulnerability in the WP Recipe Maker WordPress plugin (brechtvds) affecting all versions up to 9.1.0. The issue is due to insufficient sanitization of the 'header_tag' attribute in the plugin's shortcode functionality, allowing authenticated users with contributor or higher privileges to inject malicious scripts. These scripts execute in the context of any user who accesses the compromised page, potentially leading to session hijacking or other script-based attacks. The vulnerability has a CVSS v3.1 base score of 6.4, reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial impact on confidentiality and integrity.

An attacker with contributor-level or higher permissions can exploit this vulnerability to inject and store malicious scripts within pages generated by the WP Recipe Maker plugin. These scripts execute in the browsers of users who visit the affected pages, potentially compromising user sessions or data confidentiality and integrity. There is no indication of impact on availability. No known exploits in the wild have been reported at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions to trusted users only and consider disabling or removing the WP Recipe Maker plugin if feasible. Monitor official vendor channels for updates and apply patches promptly once released.