CVE-2026-86601
MEDIUM
NVD
CVSS Score
6.5
Severity
MEDIUM
Published
Sep 23, 2026
Vendor
unknown
Description
The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page's structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.