Threats tagged 'ghsa-9j5m-mgr6-gp3g'

WP Delicious WordPress plugin versions prior to 1.10.8 contain a cross-site scripting (XSS) vulnerability. This occurs because the plugin does not properly validate or escape HTML tag names from user-supplied recipe block data before rendering on the front end. Users with Contributor role or higher can exploit this to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.