CVE-2026-92411

MediumCVSS 6.8

Published: 26/09/2026(UTC)Updated: 28/09/2026(UTC)Translated: 26/09/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.24%

13th percentile - higher than 13% of all known CVEs

Summary

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end. This allows users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.

Risk Assessment

A low-privileged user can inject malicious JavaScript that runs in the browsers of visitors viewing the recipe page, risking session theft or account takeover. Any site running the vulnerable plugin version is affected.

Recommendation

Update the WP Delicious plugin to version 1.10.8 or later. Until then, restrict Contributor roles and review recipe content for suspicious HTML tags.

Other vulnerabilities in WP Delicious WordPress plugin

CVE-2026-14305Medium
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions. Unauthenticated users can modify limited post metadata (a like counter and associated identifier list) on arbitrary posts, including inflating the counter and growing stored metadata without bound.

Original NVD description (English source)

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS