What is GHSA-9j5m-mgr6-gp3g?

GHSA-9j5m-mgr6-gp3g is a security advisory published by GitHub Security Advisories with Medium severity. The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name...

Which CVE IDs does GHSA-9j5m-mgr6-gp3g cover?

GHSA-9j5m-mgr6-gp3g covers the following CVE IDs: CVE-2026-92411. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-9j5m-mgr6-gp3g?

GHSA-9j5m-mgr6-gp3g has a CVSS v3 base score of 6.8, published by GitHub Security Advisories.

GHSA-9j5m-mgr6-gp3gMediumCVSS 6.8

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name...

Vendor

GitHub Security Advisories

Published

September 26, 2026

Last Modified

September 27, 2026

🔗 CVE IDs covered (1)

CVE-2026-92411 →

📋 Description

The WP Delicious WordPress plugin before 1.10.8 does not validate or escape the HTML tag name taken from user-supplied recipe block data before rendering it on the front end, allowing users with the Contributor role and above to inject arbitrary HTML tags, including script tags, which execute when the recipe page is viewed.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-92411
https://wpscan.com/vulnerability/f76a4694-8073-41fe-bb49-4073e6e95ac3
https://github.com/advisories/GHSA-9j5m-mgr6-gp3g