CVE-2026-15099 is a stored cross-site scripting vulnerability in the WP Delicious – Recipe Plugin for Food Bloggers. The flaw exists because the wrap_direction_text() function directly interpolates user-supplied href values from nested link nodes into anchor tags without proper sanitization or URL scheme validation. This allows authenticated attackers with Contributor-level privileges or higher to inject arbitrary web scripts, including javascript: URIs, into pages. These scripts execute when other users access the injected content and click the malicious links. The vulnerability is present in versions up to and including 1.10.2. No official patch or remediation has been confirmed by the vendor at this time.

An attacker with Contributor-level access or higher can inject malicious scripts into the website content, which execute in the context of users who view and interact with the affected pages. This can lead to unauthorized actions performed on behalf of users, data theft, or other client-side impacts. The vulnerability does not affect availability but impacts confidentiality and integrity. The CVSS 3.1 base score is 6.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, no user interaction, and partial confidentiality and integrity impact.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict Contributor-level access to trusted users only and consider reviewing or sanitizing user-generated content before publishing. Avoid clicking suspicious links in previewed content. Monitor vendor channels for updates and apply patches promptly once available.