{"vulnerability": "CVE-2026-89274", "sightings": [{"uuid": "fdf0e26b-fcb6-46fb-95c4-45ff172420f5", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89274", "type": "seen", "source": "https://infosec.exchange/users/offseq/statuses/117295469276201522", "content": "WP Recipe Maker <=10.8.1 hit by CVE-2026-89274: CRITICAL code injection via unsanitized shortcodes in comment ratings. Unauthenticated attackers can trigger arbitrary shortcode execution on recipe pages. Upgrade ASAP. https://radar.offseq.com/threat/cve-2026-89274-cwe-94-improper-control-of-generation-of-code-code-injection-in-brechtvds-wp-recipe-77a2426acb987f3a #OffSeq #WordPress #CVE202689274 #Infosec", "creation_timestamp": "2026-09-19T03:00:24.336980Z"}, {"uuid": "5ef33868-e6fd-460c-b7ce-eb9fcdafe028", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89274", "type": "seen", "source": "https://bsky.app/profile/offseq.bsky.social/post/3mvtovz5m6n2e", "content": "WP Recipe Maker up to 10.8.1 is vulnerable (CVE-2026-89274, CRITICAL). Attackers can inject malicious shortcodes via approved comments. Update your plugin and review comment moderation settings. https://radar.offseq.com/threat/cve-2026-89274-cwe-94-improper-control-of-generation-of-code-code-inje...", "creation_timestamp": "2026-09-19T03:00:28.656957Z"}, {"uuid": "812d9a08-77fc-445a-8be6-eab93899a37b", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://bsky.app/profile/stemshop.bsky.social/post/3mvtsnruebc2r", "content": "\ud83d\udea8 CVE-2026-89274 \u2014 CVSS 9.1 CRITICAL\n\nThe WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all versions up ...\n\n\ud83d\udd0e https://stemshop.top/cve/CVE-2026-89274\n\n#CVE #CyberSecurity #InfoSec", "creation_timestamp": "2026-09-19T04:07:25.163044Z"}, {"uuid": "684ebba1-b869-40a2-896f-ba4f2625f96f", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mvtvoxh6cl2g", "content": "Daily IT Security Digest \u2014 2026-09-19\n# Daily IT Security Digest \u2014 2026-09-19\n\n1. **WP Recipe Maker: Critical Code Injection (CVE-2026-89274)**\n   WordPress plugin WP Recipe Maker (\u226410.8.1) is vulnerable to unauthenticated arbitrary shortcode execution via unsanitized shortcodes in recipe comment", "creation_timestamp": "2026-09-19T05:01:45.763261Z"}, {"uuid": "b5b9393f-f2d3-40cf-84f4-502eacb342df", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "cve-2026-89274", "type": "seen", "source": "https://bsky.app/profile/hermes71.bsky.social/post/3mvtvoxpiyd2u", "content": "Daily IT Security Digest \u2014 2026-09-19\nAttackers can trigger arbitrary shortcode execution on recipe pages without authentication. Upgrade to the latest version immediately.\n   \u2014 Source: [offseq](https://radar.offseq.com/threat/wp-recipe-maker-cve-2026-89274),", "creation_timestamp": "2026-09-19T05:01:46.285630Z"}, {"uuid": "8663b018-7b22-487d-9bcf-368c85d9bc62", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://bsky.app/profile/stackflag.bsky.social/post/3mvu36redsw25", "content": "CVE-2026-89274\nThe WP Recipe Maker plugin for WordPress lets anyone who can post a comment that gets approved add code that runs on every recipe page. This could cause hidden data or other site content to be shown to\u2026\n\nToo many irrelevant or confusing CVEs? Use stackflag.com\n\n#CVE #infosec", "creation_timestamp": "2026-09-19T06:40:05.326625Z"}, {"uuid": "e0bde1d7-6d9b-498b-b0a2-b548da5b3198", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "CVE-2026-89274", "type": "seen", "source": "https://bsky.app/profile/thehackerwire.bsky.social/post/3mvu4kqj7ab2s", "content": "\ud83d\udd34 CVE-2026-89274 - Critical (9.1)\n\nThe WP Recipe Maker plugin for WordPress is vulnerable to Arbitrary Shortcode Execution in all ve...\n\nhttps://www.thehackerwire.com/vulnerability/CVE-2026-89274/\n\n#infosec #cybersecurity #CVE #vulnerability #security #patchstack", "creation_timestamp": "2026-09-19T07:04:41.179869Z"}]}