PT-2026-47275 · WordPress · Recipe Card Blocks Lite

Athiwat Tiprasaharn + 1 · Published 2026-06-08 · Updated 2026-06-08 · CVE-2026-3011

Positive Technologies (AI Summary)

CVSS v3.1

6.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Recipe Card Blocks Lite versions prior to 3.4.14

Description The Recipe Card Blocks Lite plugin for WordPress contains a Stored Cross-Site Scripting issue. The WPZOOM Helpers::deserialize block attributes() function converts unicode-encoded sequences back into HTML characters after sanitization is performed. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts through the summary and notes attributes of the recipe block. These scripts execute when a user views the published post or the print view of the affected recipe.

Recommendations Update the plugin to a version later than 3.4.13.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2026-3011

Affected Products

Recipe Card Blocks Lite

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2026-3011 · Security Note
• https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/classes/class-wpzoom-print-template-manager.php#L224 · Note
• https://twitter.com/CVEnew/status/2063958154115797326 · Twitter Post
• https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/structured-data-blocks/class-wpzoom-recipe-card-block.php#L582 · Note
• https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/classes/class-wpzoom-helpers.php#L253 · Note
• https://wordfence.com/threat-intel/vulnerabilities/id/a684bf5f-7cf6-43b1-b457-fdc2ba74852d?source=cve · Note
• https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/structured-data-blocks/class-wpzoom-recipe-card-block.php#L592 · Note
• https://plugins.trac.wordpress.org/changeset/3470036 · Note