What the vulnerability does
01Description
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' attributes in all versions up to, and including, 3.4.13. This is due to the 'WPZOOM_Helpers::deserialize_block_attributes' method converting unicode-encoded sequences back into HTML characters after sanitization has already been applied. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the published post or the print view of an injected recipe.
Explanation of Vulnerability in Simple Terms
02Summary
Recipe Card Blocks Lite versions up to 3.4.13 contain a stored cross-site scripting (XSS) vulnerability. An authenticated user with low privileges can inject malicious scripts into recipe card content. When other users view the affected content, the scripts execute in their browsers, potentially allowing the attacker to steal session tokens, modify page content, or perform actions on their behalf. The vulnerability affects all site visitors due to scope change.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts into recipe cards that execute when other users view the content.
Potential impact on your site
04Site Impact
Visitors viewing recipe cards may have their sessions hijacked or see malicious content injected into pages.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege authenticated account (e.g., contributor or subscriber role).
Key dates
06Disclosure timeline
June 8, 2026
CVE published
June 8, 2026
Record updated
