CVE-2026-115281

MediumCVSS 6.8

Published: 28/10/2026(UTC)Updated: 28/10/2026(UTC)Translated: 28/10/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.30%

22th percentile - higher than 22% of all known CVEs

Summary

The Recipe Card Blocks Lite plugin for WordPress before 3.6.4 does not sanitize or cast a block and shortcode attribute before concatenating it into SQL queries. This allows authenticated users with Contributor-level access or above to perform SQL injection attacks.

Risk Assessment

A low-privileged user can inject arbitrary SQL and read the contents of the WordPress database, including other users' data and password hashes.

Recommendation

Update the Recipe Card Blocks Lite plugin to version 3.6.4 or later. Consider limiting Contributor-role accounts to the necessary minimum.

Other vulnerabilities in Recipe Card Blocks Lite

CVE-2026-3011Medium
The Recipe Card Blocks Lite plugin for WordPress up to version 3.4.13 is vulnerable to Stored Cross-Site Scripting via the 'summary' and 'notes' attributes of the recipe block. The WPZOOM_Helpers::deserialize_block_attributes method converts unicode sequences back to HTML characters after sanitization, allowing authenticated attackers with Author-level access or higher to inject arbitrary scripts.

Original NVD description (English source)

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS