CVE-2026-7877: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Bootstrapped Ventures WP Recipe Maker Premium

CVE-2026-7877 is a stored cross-site scripting vulnerability in the WP Recipe Maker Premium WordPress plugin, affecting all versions up to and including 10.5.0. The flaw arises from improper neutralization of user-supplied input in the 'wprm-call-to-action' shortcode, allowing authenticated attackers with contributor-level privileges or higher to inject arbitrary web scripts. These scripts execute in the context of any user accessing the compromised page, potentially leading to information disclosure or session hijacking. No official patch or remediation level has been published as of the data provided.

An attacker with contributor-level or higher access can inject persistent malicious scripts into pages via the vulnerable shortcode. This can lead to execution of arbitrary JavaScript in the context of users viewing the page, potentially resulting in theft of sensitive information, session tokens, or other user-targeted attacks. The vulnerability does not affect availability but impacts confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict contributor-level access to trusted users only and consider disabling or removing the 'wprm-call-to-action' shortcode if feasible to reduce exposure.