What’s Vulnerable › Vulnerabilities
CVE-2026-92411: WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name
- Severity: medium (CVSS 6.8 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.2% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2026-09-26 · updated 2026-09-28
- Weakness: CWE-79
Description
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.
Affected products
- WP Delicious: before 1.10.8 — fixed in 1.10.8
How to fix
Upgrade to a fixed version: WP Delicious 1.10.8. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2026-92411 or the next vulnerability affects your stack