Is CVE-2026-3011 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-3011 being exploited in the wild.

How severe is CVE-2026-3011?

Medium severity, with a CVSS score of 6.4, published 8 June 2026.

Which products and versions are affected?

WPZOOM Recipe Card Blocks Lite Up to, and including, 3.4.13.

Is there a fix for CVE-2026-3011?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-3011 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-3011?

Check whether you run WPZOOM Recipe Card Blocks Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-3011: WPZOOM Recipe Card Blocks Lite Stored XSS in recipe attributes

CVE-2026-3011 · Severity: medium · CVSS 6.4 · Published 2026-06-08

The Recipe Card Blocks Lite plugin for WordPress, which allows website owners to display formatted recipes, contains a security flaw in how it handles recipe summaries and notes. An attacker with at least Author-level permissions can inject malicious scripts into these fields. When other users, including site administrators or visitors, view the affected recipe or its print version, the script will execute in their browser, potentially leading to unauthorized actions or data theft.

Technologies: WPZOOM Recipe Card Blocks Lite. Vendors: WPZOOM.

Quick answers

Is CVE-2026-3011 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-3011 being exploited in the wild.
How severe is CVE-2026-3011?: Medium severity, with a CVSS score of 6.4, published 8 June 2026.
Which products and versions are affected?: WPZOOM Recipe Card Blocks Lite Up to, and including, 3.4.13.
Is there a fix for CVE-2026-3011?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-3011 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-3011?: Check whether you run WPZOOM Recipe Card Blocks Lite at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Recipe Card Blocks Lite plugin due to improper handling of block attributes. Specifically, the 'WPZOOM_Helpers::deserialize_block_attributes' method converts unicode-encoded sequences back into HTML characters after sanitization has already occurred, effectively bypassing security filters. Authenticated attackers with Author-level access or higher can exploit this by injecting malicious scripts into the 'summary' or 'notes' attributes of a recipe block. These scripts execute when a user views the published post or the recipe's print view. The issue is addressed in versions following 3.4.13.

Affected products

WPZOOM Recipe Card Blocks Lite Up to, and including, 3.4.13

Timeline

2026-06-08: disclosed: Initial disclosure and NVD publication
2026-06-08: advisory: Wordfence advisory published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.