CVE-2026-3011

Name of the Vulnerable Software and Affected Versions Recipe Card Blocks Lite versions prior to 3.4.14

Description The Recipe Card Blocks Lite plugin for WordPress contains a Stored Cross-Site Scripting issue. The WPZOOM Helpers::deserialize block attributes() function converts unicode-encoded sequences back into HTML characters after sanitization is performed. This allows authenticated attackers with Author-level access or higher to inject arbitrary web scripts through the summary and notes attributes of the recipe block. These scripts execute when a user views the published post or the print view of the affected recipe.

Recommendations Update the plugin to a version later than 3.4.13.