CVE-2026-92411: WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name
Published Sep 26, 2026
·Updated
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.
Affected Software
1 affected component
WP Delicious WP Delicious WordPress plugin<1.10.8
Event History
Sep 26, 2026
CVE Published
via MITRE·06:00 AM
Data Sourced
via MITRE·06:00 AM
DescriptionWeakness
Data Sourced
via NVD·07:17 AM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Which users could exploit this issue?
Users with the Contributor role or higher could supply malicious recipe block data. The issue does not require an unauthenticated attacker.
2
When does the injected code execute?
The malicious HTML, including script tags, is rendered on the front end and executes when a visitor views the affected recipe page.
3
Which plugin versions are affected?
WP Delicious versions before 1.10.8 are affected.