high · CVSS v3 7.5

CVE-2026-122060

The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password p…

Description

The WP Recipe Maker WordPress plugin before 10.9.2 does not check whether the post a recipe is embedded in is password protected before returning the recipe through its REST API and structured data output, allowing unauthenticated users to read the full content of recipes in password-protected posts.

Scores

Severity
high
CVSS v2
5
CVSS v3
7.5
CVSS v4
—
EPSS
—

← All CVEs

Related CVEs

high

CVE-2026-123558

Zebra zebrad before 7.0.0 is vulnerable to a denial‑of‑service that can be triggered by a malicious peer during checkpoint synchronization. By cancelling the verifier rewind after a failed commit, an attacker can cause the node to reject legitimate blocks until it is restarted. This disrupts network availability and can stall consensus.

View analysis

high

CVE-2026-123559

Zebra before 7.0.0 contains an inefficient algorithmic complexity vulnerability that allows unauthenticated peers to exhaust verification threads by submitting transactions with many transparent inputs. Attackers can relay invalid transactions with tens of thousands of inputs, forcing quadratic ZIP-244 or ZIP-243 digest recomputation that stalls Rayon-backed block verification for minutes.

View analysis

high

CVE-2026-123560

Zebra before 7.0.0 contains an incomplete cleanup vulnerability that allows unauthenticated peers to stall initial sync by serving a forged checkpoint block body. Attackers can supply a body with forged authorizing data near the final checkpoint, leaving rejected hashes in the sent-hash set so the node stops requesting blocks until restart.

View analysis

high

CVE-2026-123562

devalue (sveltejs/devalue) 5.8.0 before 5.9.3 contains an unhandled promise rejection in stringifyAsync: when serializing multiple promises, a later promise rejecting before an earlier one settles leaves an internal rejection unhandled, even if the caller catches the returned promise. An attacker able to influence the timing or failure of serialized asynchronous values can terminate the Node.js process.

View analysis