Wp Delicious
Monthly
Unauthenticated post metadata manipulation in WP Delicious (WordPress plugin before 1.10.2) allows any remote actor to inflate "like" counters and grow an associated identifier list on arbitrary posts without any credentials or user interaction. The flaw stems from a missing authorization check on a WordPress AJAX action accessible to unauthenticated visitors. A publicly available proof-of-concept exists; SSVC confirms automatable exploitation with partial technical impact, though no CISA KEV listing indicates active widespread exploitation has not been confirmed.
Missing authorization in WP Delicious WordPress plugin versions up to 1.9.5 enables unauthenticated remote attackers to bypass access controls and read sensitive information due to incorrectly configured access restrictions. The vulnerability allows unauthorized information disclosure with low CVSS impact (5.3) but affects a widely deployed WordPress plugin; exploitation likelihood is minimal (EPSS 0.02%, percentile 4%) and no public exploit code has been identified.
The WP Delicious - Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Delicious Delicious Recipes - WordPress Recipe Plugin allows Stored XSS.6.7. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
Unauthenticated post metadata manipulation in WP Delicious (WordPress plugin before 1.10.2) allows any remote actor to inflate "like" counters and grow an associated identifier list on arbitrary posts without any credentials or user interaction. The flaw stems from a missing authorization check on a WordPress AJAX action accessible to unauthenticated visitors. A publicly available proof-of-concept exists; SSVC confirms automatable exploitation with partial technical impact, though no CISA KEV listing indicates active widespread exploitation has not been confirmed.
Missing authorization in WP Delicious WordPress plugin versions up to 1.9.5 enables unauthenticated remote attackers to bypass access controls and read sensitive information due to incorrectly configured access restrictions. The vulnerability allows unauthorized information disclosure with low CVSS impact (5.3) but affects a widely deployed WordPress plugin; exploitation likelihood is minimal (EPSS 0.02%, percentile 4%) and no public exploit code has been identified.
The WP Delicious - Recipe Plugin for Food Bloggers (formerly Delicious Recipes) plugin for WordPress is vulnerable to arbitrary file movement and reading due to insufficient file path validation in. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, low attack complexity.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in WP Delicious Delicious Recipes - WordPress Recipe Plugin allows Stored XSS.6.7. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.