CVE-2026-15099

The Delicious Recipes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'steps' block attribute in versions up to, and including, 1.10.2. This is due to insufficient input sanitization and output escaping in the wrap_direction_text() function, which interpolates the user-supplied href value from nested link nodes ($node['props']['href']) directly into an anchor tag via sprintf() at line 1627 without esc_url() or any URL scheme validation. This makes it possible for authenticated attackers, with Contributor-level access and above, to inject arbitrary web scripts (including javascript: URIs) in pages that will execute whenever a user (such as an editor or administrator previewing the pending post) accesses an injected page and clicks the malicious link.

• CWE-79

• https://plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.10.2/src/blocks/dynamic-blocks/class-delicious-dynamic-recipe-card.php#L1288
• https://plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.10.2/src/blocks/dynamic-blocks/class-delicious-dynamic-recipe-card.php#L1627
• https://plugins.trac.wordpress.org/browser/delicious-recipes/tags/1.10.2/src/blocks/dynamic-blocks/class-delicious-dynamic-recipe-card.php#L363
• https://plugins.trac.wordpress.org/changeset/3605415/delicious-recipes
• https://www.wordfence.com/threat-intel/vulnerabilities/id/4a89c812-a643-47c0-bd33-cfb2389a7646?source=cve

Published

Jul 16, 2026

Last Modified

Jul 16, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-1509The Avada (Fusion) Builder plugin for WordPress is vulnerabl…5.4
• CVE-2026-15091IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a…9.3
• CVE-2026-15093IBM Engineering AI Hub 1.0.0, 1.1.0, and 1.2.0 could allow a…4.3
• CVE-2026-15094The WP Hotel Booking plugin for WordPress is vulnerable to R…6.1
• CVE-2026-15096The Themify Builder plugin for WordPress is vulnerable to St…6.4
• CVE-2026-15097The Themify Builder plugin for WordPress is vulnerable to St…6.4
• CVE-2026-15100The Post Grid Gutenberg Blocks – PostX plugin for WordPress …6.4
• CVE-2026-15103The WPFunnels – Funnel Builder for WooCommerce with Checkout…8.8
• CVE-2026-15104The BetterDocs – AI Documentation, Knowledge Base, Docs, Wik…6.5
• CVE-2026-15105A flaw has been found in davenardella snap7 up to 1.4.3. Thi…6.3
• CVE-2026-15106The WPBot – AI ChatBot for Live Support, Lead Generation, AI…5.3
• CVE-2026-15107Use after free in IndexedDB in Google Chrome prior to 150.0.…8.8