CVE-2026-15099: Delicious Recipes WordPress XSS Flaw

CVE-2026-15099 Overview

CVE-2026-15099 is a Stored Cross-Site Scripting (XSS) vulnerability [CWE-79] in the Delicious Recipes plugin for WordPress, affecting all versions up to and including 1.10.2. The flaw resides in the wrap_direction_text() function, which interpolates a user-supplied href value from nested link nodes directly into an anchor tag without URL sanitization. Authenticated attackers with Contributor-level access or higher can inject arbitrary JavaScript, including javascript: URIs, into recipe step content. The payload executes when an editor or administrator previews the post and clicks the malicious link.

Critical Impact
Contributor-level users can inject persistent JavaScript that executes in the browsers of higher-privileged reviewers, enabling session theft and privilege escalation on WordPress sites running the Delicious Recipes plugin.

Affected Products

Delicious Recipes plugin for WordPress, versions up to and including 1.10.2
WordPress sites permitting Contributor-level (or higher) user registration with the plugin active
Sites where editors or administrators preview pending posts containing recipe blocks

Discovery Timeline

2026-07-16 - CVE-2026-15099 published to NVD
2026-07-16 - Last updated in NVD database

Technical Details for CVE-2026-15099

Vulnerability Analysis

The vulnerability exists within the dynamic recipe card block rendering logic in class-delicious-dynamic-recipe-card.php. When the plugin renders recipe steps, the wrap_direction_text() function processes nested block nodes representing links. The function reads the href attribute from $node['props']['href'] and passes it into a sprintf() call at line 1627 that constructs an HTML anchor element. Because the value is interpolated directly into the href attribute of the generated <a> tag, any attacker-controlled string becomes part of the final rendered HTML served to viewers.

WordPress provides esc_url() specifically to filter link destinations and reject dangerous URL schemes such as javascript:, data:, and vbscript:. This function was omitted from the affected code path. As a result, the plugin trusts arbitrary strings supplied by any user permitted to author recipe content.

Root Cause

The root cause is missing input sanitization and output escaping. The wrap_direction_text() function does not call esc_url() on the href value before rendering, nor does it perform any URL scheme allowlist validation. Contributors in WordPress can create draft posts containing arbitrary block content, meaning the untrusted href reaches HTML output without ever passing through a validation routine.

Attack Vector

An authenticated user with Contributor privileges creates a draft post containing a Delicious Recipes recipe card block. Within a step, the attacker inserts a link node whose href property is set to a javascript: URI containing arbitrary script. When an editor or administrator opens the pending post preview and clicks the injected link, the browser executes the attacker's script in the site's origin. The attacker can steal session cookies, perform CSRF-style actions as the reviewer, or create a new administrator account.

Refer to the WordPress Dynamic Block Code at line 1627 and the WordFence Vulnerability Report for full technical context.

Detection Methods for CVE-2026-15099

Indicators of Compromise

Recipe step content containing href values beginning with javascript:, data:, or other non-HTTP schemes.
Unexpected administrator or editor account creation shortly after a Contributor previews or publishes a recipe.
Outbound requests from admin browser sessions to attacker-controlled domains referenced within recipe blocks.
WordPress audit log entries showing Contributor edits to posts immediately preceding privileged account actions.

Detection Strategies

Scan the wp_posts table for recipe block content containing javascript: or encoded variants such as javascript: within link nodes.
Deploy a Web Application Firewall (WAF) rule to inspect POST bodies to /wp-json/wp/v2/posts and admin-ajax.php for suspicious href schemes in recipe block payloads.
Correlate Contributor account activity with subsequent privileged actions using centralized log analysis.

Monitoring Recommendations

Log and alert on all role changes and new user creations on WordPress sites running the plugin.
Monitor Content Security Policy (CSP) violation reports for inline script executions on post preview URLs.
Track the plugin version across WordPress deployments and flag any host still running 1.10.2 or earlier.

How to Mitigate CVE-2026-15099

Immediate Actions Required

Update the Delicious Recipes plugin to a version later than 1.10.2 that includes the patch referenced in the WordPress Delicious Recipes Changeset 3605415.
Audit all pending and published recipe posts for malicious href values in step blocks and remove any suspicious content.
Review Contributor and Author accounts, disabling any unrecognized or dormant users.
Rotate administrator session cookies and force password resets for privileged accounts that previewed untrusted recipe content.

Patch Information

The vendor addressed the issue in the changeset published at WordPress Delicious Recipes Changeset 3605415. The fix adds proper sanitization to the href value processed in wrap_direction_text(), ensuring dangerous URL schemes are rejected before HTML rendering. Site owners should install the updated release through the WordPress plugin dashboard or via WP-CLI.

Workarounds

Temporarily deactivate the Delicious Recipes plugin until the patched version is deployed.
Restrict Contributor-level registrations and require higher trust before allowing recipe authoring.
Deploy a Content Security Policy that blocks inline script execution and javascript: URIs site-wide.
Instruct editors and administrators to avoid clicking links inside pending post previews until the plugin is updated.

bash

# Update Delicious Recipes plugin via WP-CLI
wp plugin update delicious-recipes

# Verify installed version is above 1.10.2
wp plugin get delicious-recipes --field=version

# Search post content for javascript: URIs in recipe blocks
wp db query "SELECT ID, post_title FROM wp_posts WHERE post_content LIKE '%javascript:%' AND post_content LIKE '%delicious-recipes%';"