UNKNOWN NVD

CVE-2026-92411

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.

References

https://wpscan.com/vulnerability/f76a4694-8073-41fe-bb49-4073e6e95ac3/

Published: 2026-09-26 · Source: NVD · Feed updated: 2026-09-26

This unknown severity vulnerability was published on 2026-09-26 via NVD.

vulnfeed aggregates 11562 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.