The WP EASY RECIPE plugin for WordPress, developed by WP-EXPERTS.IN, contains a stored cross-site scripting vulnerability identified as CVE-2024-51622. This issue is due to improper input sanitization during web page generation, which can lead to the injection and execution of malicious scripts. The vulnerability affects all versions up to and including 1.6. The CVSS 3.1 base score is 6.5, reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and impacts on confidentiality, integrity, and availability. No patch or vendor advisory is currently available to confirm remediation status.

Successful exploitation of this stored XSS vulnerability could allow an attacker with low privileges to inject malicious scripts that execute in the context of other users viewing the affected pages. This may lead to partial compromise of confidentiality, integrity, and availability of the affected system or user data. However, exploitation requires user interaction and low privileges, which somewhat limits the risk. There are no known active exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should consider restricting access to the plugin features to trusted users only and monitor for suspicious activity related to script injection. Avoid enabling the plugin on high-risk or public-facing sites if possible. Follow up with WP-EXPERTS.IN for updates on patches or official mitigations.