WP Delicious EUVD-2026-87535

Requires an authenticated account with the Contributor role or higher on the target WordPress site running WP Delicious before 1.10.8; the attacker must be able to create/edit a recipe block (the plugin's core feature). Exploitation depends on the unvalidated HTML tag name field in user-supplied recipe block data. Payload execution requires victim interaction (UI:R) - an administrator or visitor must view the published recipe page. Limiting factors: the contributor authentication barrier means this is not remotely exploitable against anonymous users, and sites that restrict recipe authorship to trusted users face lower practical risk; stored payloads on public recipe pages, however, will hit any casual visitor.

This is a stored/persistent Cross-Site Scripting flaw (CWE-79) in the WP Delicious recipe plugin, rated by the vendor at CVSS 6.8 (CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H). The signals point to a moderate, not urgent, priority. EPSS is very low at 0.15% (4th percentile), there is no CISA KEV listing, and the SSVC framework returns Exploitation: none and Automatable: no - indicating no observed exploitation and that this is not mass-scannable/wormable (it requires an authenticated contributor account). Countering this, a public POC exists via WPScan and SSVC rates Technical Impact as 'total', reflecting that arbitrary script execution in the admin/visitor browser context can fully compromise the affected session. Note two conflicts in the supplied vector: the description states 'Contributor role and above,' which is a LOW-privilege authenticated role and better maps to PR:L, yet the vendor vector uses PR:H - the vendor OVERSTATES the access barrier. Simultaneously the C:H/I:H/A:H impact metrics are INFLATED for a same-scope stored XSS, which normally yields limited C/I and no A. Net effect: this is a real but bounded issue gated behind an authenticated contributor account, best treated as medium priority - patch promptly but it is not a drop-everything emergency.

An attacker who holds (or phishes/registers into) a Contributor account on a WP Delicious site edits a recipe block and injects a malicious HTML tag name containing a script payload, which is stored unescaped. When an administrator or ordinary visitor later views the published recipe page, the script executes in their browser under the site's origin, enabling session/cookie theft or admin actions via the victim's authenticated session. A public POC is available from WPScan, lowering the effort to reproduce.