CVE-2024-0380CWE-22

WP Recipe Maker <= 9.1.0 - Directory Traversal

Medium · published February 5, 2024

CVSS v3.1
5.4
EPSS
1%
Percentile
56.3
In the wild
Unconfirmed
What it is

The WP Recipe Maker plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 9.1.0 via the 'icon' attribute used in Shortcodes. This makes it possible for authenticated attackers, with contributor-level access and above, to include the contents of SVG files on the server, which can be leveraged for Cross-Site Scripting.

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00803 · 56.3th percentile
Weakness
CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Published
2024-02-05T21:21Z
EPSS history
Timeline
  • 05 FEB 21:21Z
    WP Recipe Maker <= 9.1.0 - Directory Traversal
    cvelistv5