Description

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.8",
  "pubDate": "2026-09-26T07:17:03.023Z",
  "pubdate": "2026-09-26T07:17:03.023Z",
  "executiveSummary": "The WP Delicious WordPress plugin before version 1.10.8 is susceptible to a Stored Cross-Site Scripting (XSS) vulnerability.\nThis vulnerability originates from the improper validation and sanitization of user-supplied input used within recipe block data.\nAuthenticated attackers with the Contributor role or higher can inject malicious HTML and JavaScript payloads into recipe blocks.\nWhen a user or administrator views a page containing the affected recipe block, the injected script executes within the context of the viewer's browser.\nThe risk implication is significant, as successful exploitation can lead to unauthorized actions performed on behalf of the victim, theft of session cookies, or redirection to malicious sites.\nThe attack is limited to authenticated users; however, the Contributor role is a standard privilege level on many WordPress installations, increasing the attack surface.\nRemediation requires upgrading the plugin to version 1.10.8 or later, where input sanitization and output escaping have been implemented.",
  "technicalDetails": "The vulnerability is classified as Stored Cross-Site Scripting (XSS), stemming from the application's failure to properly sanitize or escape HTML tag names provided through recipe block inputs.\nIn WP Delicious, the rendering logic for recipe blocks incorporates user-provided metadata directly into the frontend HTML output without sufficient filtration. Because the plugin processes these tags server-side but renders them client-side without encoding, an attacker can supply crafted input that changes the structure of the resulting HTML document.\nThe root cause is an insecure implementation of the block rendering engine, which treats user-supplied string data as trusted HTML elements. When a post containing a compromised recipe block is rendered, the browser parses the malicious tag name as a legitimate HTML element.\nAn attacker possessing the Contributor role—a role typically allowed to draft and submit content—can manipulate the recipe block attributes via the WordPress block editor API. By inserting a payload such as <script>alert(document.cookie)</script> into the expected tag name field, the attacker forces the server to embed this raw payload into the post content saved in the database.\nUpon visiting the front-end page where this block is displayed, the server fetches the malicious string and injects it into the DOM. The victim's browser, lacking any restrictive Content Security Policy (CSP) or appropriate escaping mechanisms, executes the embedded JavaScript.\nThe attack flow follows these steps: 1) The attacker authenticates as a Contributor. 2) The attacker creates or edits a recipe block. 3) The attacker modifies the HTML tag name property to include an arbitrary script tag. 4) The server saves this input into the WordPress 'wp_posts' table without validation. 5) A target user (e.g., an Administrator) views the front-end post. 6) The plugin renders the malicious tag, causing the browser to execute the script in the context of the target's authenticated session.\nPost-exploitation impact includes the potential for session hijacking, unauthorized content modifications, defacement, or the execution of administrative actions through the WordPress REST API, depending on the privileges of the user viewing the page.\nThis vulnerability affects all WP Delicious versions prior to 1.10.8. It is accessible via the administrative dashboard and requires no special network conditions other than access to the WordPress editor."
}