EUVD-2026-44883
GHSA-pqvj-2p97-rfr5
Severity by source
AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
UI:R corrects the provided UI:N - description explicitly requires victim to click the link; PR:L confirmed by Contributor-level requirement; S:C reflects XSS executing in victim browser context.
Primary rating from Vendor (Wordfence).
CVSS VectorVendor: Wordfence
Lifecycle Timeline
2DescriptionCVE.org
The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrap_direction_text() function, which interpolates the user-supplied href value from nested link nodes ($node['props']['href']) directly into an anchor tag via sprintf() at line 1627 without esc_url() or any URL scheme validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts (including javascript: URIs) in pages that will execute whenever a user (such as an editor or administrator previewing the pending post) accesses an injected page and clicks the malicious link.
AnalysisAI
Stored cross-site scripting in the WP Delicious (formerly Delicious Recipes) WordPress plugin versions up to and including 1.10.2 allows authenticated Contributor-level users to inject arbitrary JavaScript via unsanitized javascript: URIs embedded in recipe step link attributes. The wrap_direction_text() function interpolates attacker-controlled href values directly into anchor tags using sprintf() without invoking WordPress's esc_url(), enabling payload execution in the browser of any privileged user who clicks the poisoned link while previewing or viewing the affected recipe post. No CISA KEV listing or public exploit code has been identified at time of analysis, though Wordfence's source-level disclosure provides sufficient detail for independent reproduction.
Technical ContextAI
The vulnerability is rooted in a CWE-79 (Stored Cross-Site Scripting) output encoding failure within the Gutenberg dynamic block rendering pipeline of the WP Delicious plugin, identified by CPE cpe:2.3:a:wpdelicious:wp_delicious_-_recipe_plugin_for_food_bloggers_(formerly_delicious_recipes). Specifically, class-delicious-dynamic-recipe-card.php at line 1627 contains the function wrap_direction_text(), which retrieves the href property from nested block link nodes ($node['props']['href']) supplied via the steps block attribute and passes it verbatim into a sprintf()-constructed anchor tag. WordPress provides esc_url() precisely to strip javascript: and data: URI schemes, but this function is absent from the affected code path. Corroborating entry points at lines 363 and 1288 of the same file indicate that the unsanitized value traverses multiple rendering stages before output. The attacker controls the href value through the Gutenberg block editor's steps attribute, which is accessible to Contributor-level users on any WordPress installation running this plugin.
RemediationAI
Upgrade the WP Delicious plugin to the version incorporating WordPress SVN changeset 3605415, which represents the upstream fix committed to the plugin repository and is viewable at https://plugins.trac.wordpress.org/changeset/3605415/delicious-recipes. The exact patched release version number is not independently confirmed from the available data beyond this changeset reference - verify the current version in the WordPress.org plugin directory before updating. If an immediate upgrade is not feasible, restrict Contributor-level user roles from creating or editing posts that use the WP Delicious recipe card block by filtering block capabilities via a WordPress user_can_richedit or block_editor_settings hook; note this will disrupt legitimate editorial workflows on food blogging sites. Alternatively, temporarily downgrade Contributor accounts to Subscriber role to remove block editor access, understanding this removes all authoring capability for those users.
More in Wordpress Plugin
View allThe Backup Migration plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 1
The Hash Form - Drag & Drop Form Builder plugin for WordPress is vulnerable to arbitrary file uploads due to missing fil
Authentication bypass in the LiteSpeed Cache WordPress plugin (versions prior to 6.5.0.1) allows unauthenticated remote
The Simple File List plugin for WordPress through version 4.2.2 contains an unauthenticated remote code execution vulner
The SureTriggers WordPress plugin through version 1.0.82 contains a privilege escalation vulnerability that allows unaut
The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via
The Business Directory Plugin - Easy Listing Directories for WordPress plugin for WordPress is vulnerable to time-based
SQL injection in the NotificationX WordPress plugin (versions up to and including 2.8.2) allows unauthenticated remote a
The POST SMTP Mailer - Email log, Delivery Failure Notifications and Best Mail SMTP for WordPress plugin for WordPress i
The MasterStudy LMS WordPress Plugin - for Online Courses and Education plugin for WordPress is vulnerable to union base
The Email Subscribers by Icegram Express plugin for WordPress is vulnerable to SQL Injection via the ‘hash’ parameter in
Remote code execution in the WP Query Console WordPress plugin (versions up to and including 1.0) by Ajit Bohra allows u
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today