The WP Delicious plugin, prior to version 1.10.8, fails to validate or escape the HTML tag name that comes from user‑supplied recipe block data. This flaw allows a user with the Contributor role or higher to insert arbitrary tag names, including <script>, into recipe content. When a visitor loads a recipe page, the injected scripts execute in the visitor’s browser, enabling session theft, defacement, or phishing. The weakness is a classic Stored Cross‑Site Scripting vulnerability identified as CWE‑79.

WordPress sites that have installed WP Delicious version earlier than 1.10.8 are affected. The vulnerability applies to all sites that allow users with the Contributor role to edit recipes, regardless of other configuration settings. Any Contributor or above can inject malicious markup that will be stored and displayed to all visitors.

The vulnerability is client‑side and requires no additional secrets beyond having Contributor access to the editor. Once a malicious tag name is stored, every user who views the affected recipe page is exposed to the payload. The EPSS score indicates an exploitation probability of less than 1%. The CVSS score of 6.8 places the flaw in the medium‑severity category, and the lack of a KEV listing does not reduce the practical risk. Because the Contributor role is commonly granted to content authors, this flaw presents an easily exploitable attack surface.