Recipe Card Blocks Lite <= 3.4.13 - Authenticated (Author+) Stored Cross-Site Scripting via 'summary' and 'notes'
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- No fix listed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.
Summary
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' attributes in all versions up to, and including, 3.4.13. This is due to the 'WPZOOM_Helpers::deserialize_block_attributes' method converting unicode-encoded sequences back into HTML characters after sanitization has already been applied. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the published post or the print view of an injected recipe.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-3011
- 2026-10-03 Alias added: GHSA-3hrr-gwwg-4mc5
References
Other 6
- https://www.wordfence.com/threat-intel/vulnerabilities/id/a684bf5f-7cf6-43b1-b457-fdc2ba74852d?source=cve
- https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/classes/class-wpzoom-print-template-manager.php#L224
- https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/classes/class-wpzoom-helpers.php#L253
- https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/structured-data-blocks/class-wpzoom-recipe-card-block.php#L582
- https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/structured-data-blocks/class-wpzoom-recipe-card-block.php#L592
- https://plugins.trac.wordpress.org/changeset/3470036/
More wpzoom vulnerabilities
- TI-2024-02034 Social Icons Widget & Block < 4.2.18 - Admin+ Stored XSS CVSS 3.1MEDIUM 6.1
- TI-2022-04385 WPZOOM Portfolio < 1.2.2 - Contributor+ Stored XSS via Shortcode CVSS 3.1MEDIUM 5.4
- TI-2024-04778 WPZOOM Addons for Elementor (Templates, Widgets) <= 1.1.37 - Unauthenticated Local File Inclusion CVSS 3.1CRITICAL 9.8
- TI-2024-20190 WordPress Social Icons Widget & Block by WPZOOM plugin <= 4.2.15 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2024-28945 WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.3.1 - Broken Access Control vulnerability CVSS 3.1HIGH 8.8
- TI-2025-07869 Inspiro <= 2.1.2 - Cross-Site Request Forgery to Arbitrary Plugin Installation CVSS 3.1HIGH 8.1
Sources
- CVE-2026-3011 · CVE Program
- CVE-2026-3011 · NVD
- FIRST EPSS
- GHSA-3hrr-gwwg-4mc5 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences