# cve.now: Brechtvds

The newest entries naming Brechtvds as an affected vendor (up to 200), of 28 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-89274](https://cve.now/CVE-2026-89274.md): WP Recipe Maker \<= 10.8.1 - Unauthenticated Arbitrary Shortcode Execution via Recipe Comment Content (CVSS 9.1)
- [CVE-2026-90884](https://cve.now/CVE-2026-90884.md): WP Recipe Maker \<= 10.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'notes' Parameter via REST Preview Endpoint (CVSS 5.4)
- [CVE-2026-75905](https://cve.now/CVE-2026-75905.md): WP Recipe Maker \<= 10.8.0 - Missing Authorization to Authenticated (Contributor+) Arbitrary Recipe Ownership Takeover and Unpublishing via '\[wprm-recipe\]' Shortcode (CVSS 4.3)
- [CVE-2026-9019](https://cve.now/CVE-2026-9019.md): Easy Image Collage \<= 1.13.6 - Authenticated (Author+) Stored Cross-Site Scripting via 'grid\[properties\]\[borderColor\]' and 'grid\[images\]\[N\]\[attachment\_url\]' Parameters (CVSS 6.4)
- [CVE-2026-1558](https://cve.now/CVE-2026-1558.md): WP Recipe Maker \<= 10.3.2 - Insecure Direct Object Reference to Unauthenticated Arbitrary Post Metadata Modification via 'recipeId' Parameter (CVSS 5.3)
- [CVE-2025-14742](https://cve.now/CVE-2025-14742.md): WP Recipe Maker \<= 10.2.3 - Missing Authorization to Authenticated (Subscriber+) Sensitive Information Exposure (CVSS 4.3)
- [CVE-2026-1268](https://cve.now/CVE-2026-1268.md): Dynamic Widget Content \<= 1.3.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via Widget Content Field (CVSS 6.4)
- [CVE-2025-15527](https://cve.now/CVE-2025-15527.md): WP Recipe Maker \<= 10.2.2 - Insecure Direct Object Reference to Sensitive Information Exposure (CVSS 4.3)
- [CVE-2025-14385](https://cve.now/CVE-2025-14385.md): WP Recipe Maker \<= 10.2.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2025-11987](https://cve.now/CVE-2025-11987.md): Visual Link Preview \<= 2.2.7 - Authenticated (Contributor+) Stored Cross-Site Scripting via visual-link-preview Shortcode (CVSS 6.4)
- [CVE-2025-1503](https://cve.now/CVE-2025-1503.md): WP Recipe Maker \<= 9.8.0 - Authenticated (Contributor+) Stored Cross-Site Scripting (CVSS 6.4)
- [CVE-2024-12825](https://cve.now/CVE-2024-12825.md): Custom Related Posts \<= 1.7.3 - Missing Authorization to Authenticated (Subscriber+) Private Post Search and Relation Updates (CVSS 5.4)
- [CVE-2024-9650](https://cve.now/CVE-2024-9650.md): WP Recipe Maker \<= 9.6.1 - Authenticated (Contributor+) DOM-Based Stored Cross-Site Scripting via 'tooltip' (CVSS 6.5)
- [CVE-2024-9051](https://cve.now/CVE-2024-9051.md): WP Ultimate Post Grid \<= 3.9.3 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-grid-with-filters Shortcode (CVSS 6.4)
- [CVE-2024-5864](https://cve.now/CVE-2024-5864.md): Easy Affiliate Links \<= 3.7.3 - Missing Authorization to Authenticated (Subscriber+) Settings Reset (CVSS 4.3)
- [CVE-2024-5863](https://cve.now/CVE-2024-5863.md): Easy Image Collage \<= 1.13.5 - Missing Authorization to Authenticated (Contributor+) Data Clearance (CVSS 5.4)
- [CVE-2024-0383](https://cve.now/CVE-2024-0383.md): WP Recipe Maker \<= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'group\_tag' (CVSS 6.4)
- [CVE-2024-4043](https://cve.now/CVE-2024-4043.md): WP Ultimate Post Grid \<= 3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wpupg-text Shortcode (CVSS 6.4)
- [CVE-2024-3490](https://cve.now/CVE-2024-3490.md): WP Recipe Maker \<= 9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via wprm-recipe-roundup-item Shortcode (CVSS 6.4)
- [CVE-2024-1571](https://cve.now/CVE-2024-1571.md): WP Recipe Maker \<= 9.2.1 - Authenticated Stored Cross-Site Scripting via Video Embed (CVSS 4.4)
- [CVE-2024-1206](https://cve.now/CVE-2024-1206.md): WP Recipe Maker \<= 9.1.2 - Missing Authorization to Authenticated (Subscriber+) SQL Injecton (CVSS 8.8)
- [CVE-2024-0384](https://cve.now/CVE-2024-0384.md): WP Recipe Maker \<= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via Recipe Notes (CVSS 6.4)
- [CVE-2024-0255](https://cve.now/CVE-2024-0255.md): WP Recipe Maker \<= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via icon\_color (CVSS 6.4)
- [CVE-2024-0380](https://cve.now/CVE-2024-0380.md): WP Recipe Maker \<= 9.1.0 - Directory Traversal (CVSS 5.4)
- [CVE-2024-0382](https://cve.now/CVE-2024-0382.md): WP Recipe Maker \<= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via header\_tag (CVSS 6.4)
- [CVE-2023-6958](https://cve.now/CVE-2023-6958.md): WP Recipe Maker \<= 9.1.0 - Authenticated(Contributor+) Stored Cross-Site Scripting via Shortcode (CVSS 6.4)
- [CVE-2024-0381](https://cve.now/CVE-2024-0381.md): WP Recipe Maker \<= 9.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' (CVSS 6.4)
- [CVE-2023-6970](https://cve.now/CVE-2023-6970.md): WP Recipe Maker \<= 9.1.0 - Reflected Cross-Site Scripting via Referer (CVSS 6.1)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/brechtvds
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.