Executive brief
WP Delicious is a WordPress plugin that displays recipe content on websites. Contributors and higher-privileged users can inject malicious code into recipe blocks, which executes as JavaScript when visitors view the recipe page, potentially stealing login credentials or compromising site functionality.
Technical details
The plugin fails to validate or escape HTML tag names from user-supplied recipe block data before rendering on the front end, enabling stored XSS injection. Contributors and above can inject arbitrary HTML and script tags that execute in the browser context of site visitors. The vulnerability requires authentication with Contributor role or higher.
Affected products
- Leaveitbetter WP Delicious before 1.10.8
Timeline
- 2026-09-24: disclosed
- 2026-09-26: patched