[ CVE-2026-92411 · Published 26 Sep 2026 ]
Vulnerability in Unknown WP Delicious
CVSS 6.8
EPSS <1%No fix listed yet
[ Description ]Official description
The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.
[ Fixes ]Fixes and patches
No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.