CVE-2024-0383 is a stored cross-site scripting vulnerability in the WP Recipe Maker plugin for WordPress, affecting all versions up to and including 9.1.0. The issue arises from insufficient input sanitization of the 'group_tag' attribute in the plugin's shortcodes [wprm-recipe-instructions] and [wprm-recipe-ingredients]. Authenticated users with contributor-level permissions or higher can inject arbitrary web scripts that execute in the context of users viewing the injected pages. The vulnerability has a CVSS 3.1 base score of 6.4, reflecting a medium severity with network attack vector, low attack complexity, and no user interaction required. The vulnerability impacts confidentiality and integrity but not availability. There is no vendor advisory or patch information provided, and no known exploits have been reported.

Successful exploitation allows authenticated contributors or higher to inject persistent malicious scripts into pages using the vulnerable shortcodes. These scripts execute in the browsers of users who visit the affected pages, potentially leading to unauthorized actions or data disclosure within the context of the WordPress site. The impact affects confidentiality and integrity but does not affect availability. There are no reports of active exploitation in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level permissions carefully and consider disabling or limiting use of the affected shortcodes. Monitor for updates from the plugin vendor regarding patches or official mitigations.