CVE-2026-86601 [MEDIUM] – The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment

The WP Recipe Maker WordPress plugin before 10.8.2 does not remove shortcodes from comment content before expanding it while building a page’s structured metadata, allowing unauthenticated users to have arbitrary shortcodes executed server side and to read the content of unpublished recipes.