The WP Delicious – Recipe Plugin for Food Bloggers allows authenticated users of Contributor level or higher to insert arbitrary JavaScript into recipe posts through the "steps" block attribute. The flaw arises from the wrap_direction_text() function, which concatenates user‑supplied href values from nested link nodes directly into an anchor tag without URL scheme validation or escaping, a classic example of CWE-79: Improper Neutralization of Input During Web Page Generation. Consequently, a malicious user can embed a javascript: URI that will execute in the browsers of any subsequent privileged user who previews or edits the post containing the injected link.

WordPress sites running the WP Delicious plugin up to version 1.10.2, inclusive, are vulnerable. The issue is present in the 1.10.2 release distributed via the WordPress plugin repository and affects all installations configured with Contributor or higher editing permissions.

The CVSS score of 6.4 categorises this as Medium severity, and the EPSS score of less than 1% indicates a low probability of widespread exploitation at the time of reporting. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires the attacker to first gain Contributor‑level access; after that, the injected code will run whenever another privileged user views the affected post. No external attack vector is required beyond normal authenticated use of the plugin.