Stored Cross-Site Scripting Vulnerability in Recipe Card Blocks Lite Plugin for WordPress

CVE-2026-3011

What is CVE-2026-3011?

The Recipe Card Blocks Lite plugin for WordPress is susceptible to Stored Cross-Site Scripting due to improper handling of user input in the recipe block's 'summary' and 'notes' attributes. The vulnerability arises from the 'WPZOOM_Helpers::deserialize_block_attributes' method, which incorrectly converts unicode-encoded sequences back into HTML characters post-sanitization. This flawed implementation allows authenticated attackers with Author-level permissions or higher to inject malicious scripts into published posts or their print views, potentially leading to unauthorized actions on user browsers.

References