CVE-2026-92411
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name…
- Risk score
- 44/100
- CVSS
- 6.8 v3.1
- Exploit chance (30 days)
- 0.2%
- Published
- 26 Sep 2026
Open in the live forecast Today's forecast
What to know
- What it is
- The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is v…
- Affected
- See advisory
- Fix
- Upgrade the product to 1.10.8 or later.
- Exploitation
- No known exploitation
Why it is Yellow
- CVSS 6.8 medium
References
Original description
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.
Last activity 26 Sep 2026. Patch Forecast updates every hour.