CVE-2026-125948

Name of the Vulnerable Software and Affected Versions Recipe Card Blocks Lite versions prior to 3.7.1

Description Insufficient input sanitization and output escaping allow authenticated attackers with contributor-level access and above to perform Stored Cross-Site Scripting. By embedding event-handler payloads within the steps[].text parameter, an attacker can inject arbitrary web scripts into pages. This occurs because the wp kses post() function preserves block-delimiter HTML comments during the save process, allowing the payload to execute for any visitor, including administrators and editors who preview or publish the post, as well as through the public print endpoint.

Recommendations Update to a version newer than 3.7.0. Avoid using the steps[].text parameter for untrusted input until the update is applied.