CVE-2025-58605
MediumCVSS 6.5Exploitation Probability (EPSS)
Low risk10th percentile - higher than 10% of all known CVEs
Summary
The WP Delicious plugin through version 1.8.7 contains a Stored XSS vulnerability due to improper neutralization of input during web page generation. A malicious script is stored and executed in users' browsers.
Risk Assessment
An attacker can store a malicious script that executes in users' browsers on the recipe site, enabling session hijacking or actions on their behalf. This affects confidentiality and integrity.
Recommendation
Update the WP Delicious plugin to a version later than 1.8.7. Deploy input validation and a WAF.
Other vulnerabilities in WP Delicious
See all- CVE-2026-39528Medium
The WP Delicious plugin contains a missing authorization vulnerability that allows exploiting incorrectly configured access control security levels. This issue affects all versions from n/a through 1.9.5.
- CVE-2025-67548Medium
The WP Delicious (delicious-recipes) plugin in versions up to 1.9.1 contains a missing authorization vulnerability. This allows exploitation of incorrectly configured access control security levels.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in WP Delicious WP Delicious delicious-recipes allows Stored XSS.This issue affects WP Delicious: from n/a through <= 1.8.7.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS