PT-2026-60438 · Wpdelicious · Wp Delicious – Recipe Plugin For Food Bloggers

Prism · CVE-2026-15099 · Published 2026-07-16 · Updated 2026-07-16

Mitre

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrap direction text() function, which interpolates the user-supplied href value from nested link nodes ($node['props']['href']) directly into an anchor tag via sprintf() at line 1627 without esc url() or any URL scheme validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts (including javascript: URIs) in pages that will execute whenever a user (such as an editor or administrator previewing the pending post) accesses an injected page and clicks the malicious link.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-15099

Affected Products

Wp Delicious – Recipe Plugin For Food Bloggers

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2026-15099 · Security Note
• https://plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.10.2/src/blocks/dynamic-blocks/class-delicious-dynamic-recipe-card.php#L1627 · Note
• https://plugins.trac.wordpress.org/changeset/3605415/delicious-recipes · Note
• https://plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.10.2/src/blocks/dynamic-blocks/class-delicious-dynamic-recipe-card.php#L1288 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/4a89c812-a643-47c0-bd33-cfb2389a7646?source=cve · Note
• https://plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.10.2/src/blocks/dynamic-blocks/class-delicious-dynamic-recipe-card.php#L363 · Note