What is the CVSS score of EUVD-2026-44883?

EUVD-2026-44883 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.2%.

WP Delicious EUVD-2026-44883

| CVE-2026-15099 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-07-16 Wordfence

GHSA-pqvj-2p97-rfr5

WordPress XSS Wordpress Plugin Wp Delicious Recipe Plugin For Food Bloggers Formerly Delicious Recipes Wpdelicious

6.4

CVSS 3.1 · Vendor: Wordfence

Severity by source

Vendor (Wordfence) PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

vuln.today AI

5.4 MEDIUM

UI:R corrects the provided UI:N - description explicitly requires victim to click the link; PR:L confirmed by Contributor-level requirement; S:C reflects XSS executing in victim browser context.

3.1 AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N

Primary rating from Vendor (Wordfence).

CVSS VectorVendor: Wordfence

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 16, 2026 - 09:01 vuln.today

CVE Published

Jul 16, 2026 - 07:51 cve.org

MEDIUM 6.4

DescriptionCVE.org

The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrap_direction_text() function, which interpolates the user-supplied href value from nested link nodes ($node['props']['href']) directly into an anchor tag via sprintf() at line 1627 without esc_url() or any URL scheme validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts (including javascript: URIs) in pages that will execute whenever a user (such as an editor or administrator previewing the pending post) accesses an injected page and clicks the malicious link.

AnalysisAI

Stored cross-site scripting in the WP Delicious (formerly Delicious Recipes) WordPress plugin versions up to and including 1.10.2 allows authenticated Contributor-level users to inject arbitrary JavaScript via unsanitized javascript: URIs embedded in recipe step link attributes. The wrap_direction_text() function interpolates attacker-controlled href values directly into anchor tags using sprintf() without invoking WordPress's esc_url(), enabling payload execution in the browser of any privileged user who clicks the poisoned link while previewing or viewing the affected recipe post. No CISA KEV listing or public exploit code has been identified at time of analysis, though Wordfence's source-level disclosure provides sufficient detail for independent reproduction.

Technical ContextAI

The vulnerability is rooted in a CWE-79 (Stored Cross-Site Scripting) output encoding failure within the Gutenberg dynamic block rendering pipeline of the WP Delicious plugin, identified by CPE cpe:2.3:a:wpdelicious:wp_delicious_-_recipe_plugin_for_food_bloggers_(formerly_delicious_recipes). Specifically, class-delicious-dynamic-recipe-card.php at line 1627 contains the function wrap_direction_text(), which retrieves the href property from nested block link nodes ($node['props']['href']) supplied via the steps block attribute and passes it verbatim into a sprintf()-constructed anchor tag. WordPress provides esc_url() precisely to strip javascript: and data: URI schemes, but this function is absent from the affected code path. Corroborating entry points at lines 363 and 1288 of the same file indicate that the unsanitized value traverses multiple rendering stages before output. The attacker controls the href value through the Gutenberg block editor's steps attribute, which is accessible to Contributor-level users on any WordPress installation running this plugin.

RemediationAI

Upgrade the WP Delicious plugin to the version incorporating WordPress SVN changeset 3605415, which represents the upstream fix committed to the plugin repository and is viewable at https://plugins.trac.wordpress.org/changeset/3605415/delicious-recipes. The exact patched release version number is not independently confirmed from the available data beyond this changeset reference - verify the current version in the WordPress.org plugin directory before updating. If an immediate upgrade is not feasible, restrict Contributor-level user roles from creating or editing posts that use the WP Delicious recipe card block by filtering block capabilities via a WordPress user_can_richedit or block_editor_settings hook; note this will disrupt legitimate editorial workflows on food blogging sites. Alternatively, temporarily downgrade Contributor accounts to Subscriber role to remove block editor access, understanding this removes all authoring capability for those users.