123 matches found
CVE-2026-92411
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...
WordPress WP Delicious plugin < 1.10.8 - Contributor+ Stored XSS vulnerability
Contributor+ Stored XSS vulnerability discovered by Philipp Doblhofer in WordPress Plugin WP Delicious versions 1.10.8...
CVE-2026-92411 WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...
EUVD-2026-87535
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...
CVE-2026-92411
The WP Delicious WordPress plugin (versions prior to 1.10.8 ) is vulnerable to Stored XSS . The root cause is a failure to validate or escape the HTML tag name extracted from user-supplied recipe block data before it is rendered on the front end. This allows authenticated users with the Contribut...
CVE-2026-92411 WP Delicious < 1.10.8 - Contributor+ Stored XSS via Recipe Block Tag Name
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...
CVE-2026-92411: Improper Neutralization of Input During Web Page Generation
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute whe...
PT-2026-99247
Name of the Vulnerable Software and Affected Versions WP Delicious WordPress plugin versions prior to 1.10.8 Description Insufficient validation and escaping of HTML tag names derived from user-supplied recipe block data allows users with the Contributor role and above to inject arbitrary HTML...
CVE-2026-14305
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...
CVE-2026-14305
The WP Delicious WordPress plugin (versions before 1.10.2 ) is vulnerable because it fails to perform an authorization check on one of its AJAX actions . This allows unauthenticated users to modify limited post metadata, such as a like counter and an associated identifier list , on arbitrary post...
EUVD-2026-51015
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...
CVE-2026-14305
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...
WordPress WP Delicious plugin < 1.10.2 - Unauthenticated Arbitrary Post Meta Update vulnerability
Unauthenticated Arbitrary Post Meta Update vulnerability discovered by Pedro Pinho in WordPress Plugin WP Delicious versions 1.10.2...
PT-2026-66386
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...
CVE-2026-14305: Improper Authentication
The WP Delicious WordPress plugin before 1.10.2 does not perform an authorization check on one of its AJAX actions, allowing unauthenticated users to modify limited post metadata a like counter and an associated identifier list on arbitrary posts, including inflating the counter and growing the...
CVE-2026-15099
The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrapdirectiontext function, which interpolates the...
CVE-2026-15099 WP Delicious <= 1.10.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'steps' Block Attribute
The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrapdirectiontext function, which interpolates the...
CVE-2026-15099
The CVE-2026-15099 instance concerns the Delicious Recipes WordPress plugin (
EUVD-2026-44883
The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrapdirectiontext function, which interpolates the...
CVE-2026-15099
The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrapdirectiontext function, which interpolates the...