CVE-2026-92411
WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name
- State
- Published
- Severity
- 6.8 Medium
- Published
- Sep 26, 2026
- Updated
- Sep 26, 2026
- Reserved
- Sep 16, 2026
Description
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 6.8 Medium | CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H | CISA-ADP |
Weaknesses
- CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Affected Products
| Product | Versions |
|---|---|
WP DeliciousUnknown |
|
References
- https://wpscan.com/vulnerability/f76a4694-8073-41fe-bb49-4073e6e95ac3/exploitvdb-entrytechnical-description
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.