Junglewise Threat Intelligence

CVE-2026-3011: WPZOOM Recipe Card Blocks Lite Stored XSS in recipe attributes

CVE-2026-3011 · Severity: medium · CVSS 6.4 · Published 2026-06-08

Vendors: WPZOOM.

Executive brief

The Recipe Card Blocks Lite plugin for WordPress, which allows website owners to display formatted recipes, contains a security flaw in how it handles recipe summaries and notes. An attacker with at least Author-level permissions can inject malicious scripts into these fields. When other users, including site administrators or visitors, view the affected recipe or its print version, the script will execute in their browser, potentially leading to unauthorized actions or data theft.

Technical details

A Stored Cross-Site Scripting (XSS) vulnerability exists in the Recipe Card Blocks Lite plugin due to improper handling of block attributes. Specifically, the 'WPZOOM_Helpers::deserialize_block_attributes' method converts unicode-encoded sequences back into HTML characters after sanitization has already occurred, effectively bypassing security filters. Authenticated attackers with Author-level access or higher can exploit this by injecting malicious scripts into the 'summary' or 'notes' attributes of a recipe block. These scripts execute when a user views the published post or the recipe's print view. The issue is addressed in versions following 3.4.13.

Affected products

  • WPZOOM Recipe Card Blocks Lite Up to, and including, 3.4.13

Timeline

  • 2026-06-08: disclosed: Initial disclosure and NVD publication
  • 2026-06-08: advisory: Wordfence advisory published

References