Recipe Card Blocks By Wpzoom Vulnerabilities

The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 3.4.18. This is due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute...

CVSS:

7.2

Affected:

up to 3.4.18

Fixed in:

3.4.19

Disclosed:

Aug 18, 2026

CVE-2026-73361 on NVD →

The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' attributes in all versions up to, and including, 3.4.13. This is due to the 'WPZOOM_Helpers::deserialize_block_attributes' method converting unicode-encoded sequences back into HTML...

CVSS:

6.4

Affected:

up to 3.4.13

Fixed in:

3.4.14

Disclosed:

Jun 7, 2026

CVE-2026-3011 on NVD →

The Recipe Card Blocks for Gutenberg & Elementor plugin for WordPress is vulnerable to SQL Injection in versions up to 3.4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with contributor-lev...

CVSS:

6.5

Affected:

up to 3.4.13

Fixed in:

3.4.13

Disclosed:

Jan 27, 2026

CVE-2025-14973 on NVD →

[en] The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.

Affected:

up to 3.4.13

Fixed in:

3.4.13

Disclosed:

Jan 26, 2026

CVE-2025-14973 on NVD →

[en] Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.8.

Affected:

up to 3.4.8

Fix:

No patched version reported

Disclosed:

Oct 22, 2025

CVE-2025-62019 on NVD →

The Recipe Card Blocks for Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on several REST-API endpoints in versions up to, and including, 3.4.8. This makes it possible for unauthenticated attackers to perform unauthorized actions.

CVSS:

7.5

Affected:

up to 3.4.8

Fixed in:

3.4.9

Disclosed:

Sep 11, 2025

CVE-2025-62019 on NVD →

[en] Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through 3.4.3.

Affected:

up to 3.4.4

Fixed in:

3.4.4

Disclosed:

Feb 25, 2025

CVE-2025-26983 on NVD →

The Recipe Card Blocks for Gutenberg & Elementor – Best WordPress Recipe Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.3 via the render() function due to insufficient restrictions on which posts can be included. This makes it possible for authenticated attac...

CVSS:

4.3

Affected:

up to 3.4.3

Fixed in:

3.4.4

Disclosed:

Feb 23, 2025

CVE-2025-26983 on NVD →

[en] Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through 3.3.1.

Affected:

up to 3.3.2

Fixed in:

3.3.2

Disclosed:

Nov 1, 2024

CVE-2024-43293 on NVD →

The Recipe Card Blocks for Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the search_recipes() and import_recipes() functions in versions up to, and including, 3.3.1. This makes it possible for authenticated attackers, with subscriber-level access an...

CVSS:

5.4

Affected:

up to 3.3.1

Fixed in:

3.3.2

Disclosed:

Aug 16, 2024

CVE-2024-43293 on NVD →

[en] The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue

Affected:

up to 2.8.3

Fixed in:

2.8.3

Disclosed:

Sep 27, 2021

CVE-2021-24632 on NVD →

[en] The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings), which could allow users with a role as low as contributor to perform Stored Cross-S...

Affected:

up to 2.8.3

Fixed in:

2.8.3

Disclosed:

Sep 27, 2021

CVE-2021-24634 on NVD →

The Recipe Card Blocks by WPZOOM plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in page...

CVSS:

6.1

Affected:

up to 2.8.1

Fixed in:

2.8.1

Disclosed:

Aug 24, 2021

CVE-2021-24632 on NVD →

The Recipe Card Blocks by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.8.2 by not properly sanitizing or escaping some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredients, recipeTitle, or settings). This makes...

CVSS:

5.4

Affected:

up to 2.8.3

Fixed in:

2.8.3

Disclosed:

Aug 24, 2021

CVE-2021-24634 on NVD →