CVE-2026-14305

MediumCVSS 5.3

Published: 30/07/2026(UTC)Updated: 30/07/2026(UTC)Translated: 30/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.15%

5th percentile - higher than 5% of all known CVEs

Summary

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions. Unauthenticated users can modify limited post metadata (a like counter and associated identifier list) on arbitrary posts, including inflating the counter and growing stored metadata without bound.

Risk Assessment

Attackers can manipulate content popularity (e.g., inflate likes) and cause excessive database storage usage due to uncontrolled metadata growth.

Recommendation

Update the WP Delicious plugin to version 1.10.2 or later.

Other vulnerabilities in WP Delicious WordPress plugin

CVE-2026-92411Medium
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end. This allows users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.

Original NVD description (English source)

The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata (a like counter and an associated identifier list) on arbitrary posts, including inflating the counter and growing the stored metadata without bound.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS