Recipe Card Blocks CVE-2026-73361

Exploitation requires that the target WordPress site runs the Recipe Card Blocks for Gutenberg & Elementor plugin at version 3.4.18 or earlier and that at least one plugin-rendered recipe card page is accessible and viewable by an authenticated user (UI:R). The CVSS PR:N rating indicates the initial injection step does not require an attacker account, meaning external unauthenticated actors can submit the payload. However, full exploitation is contingent on a victim - most plausibly an authenticated administrator or editor - visiting the page containing the injected content; purely automated victim-free exploitation is not possible. Sites where recipe card submission is restricted to authenticated contributors or administrators reduce the unauthenticated injection vector, even though the CVSS vector reflects the general-case plugin configuration. No additional non-default WordPress configuration or server-side setting is specified as required beyond the plugin being installed and active.

The CVSS 3.1 base score of 7.1 is primarily driven by the network attack vector, zero authentication requirement (PR:N), and scope change (S:C), which together lower the barrier to initial injection significantly. The required user interaction (UI:R) is the critical limiting factor - a victim, most likely an authenticated WordPress administrator or editor, must actively visit a page rendering the injected content for the payload to fire, preventing fully automated exploitation. No EPSS score was included in the available intelligence, so exploitation probability cannot be quantified from that signal. The absence of a CISA KEV entry and the lack of any referenced POC code suggest no confirmed mass exploitation at time of analysis. Real-world risk is most relevant to food-blogging or recipe-focused WordPress sites where recipe card content is publicly submittable and administrators routinely preview submissions, creating a realistic phishing or stored-XSS escalation path.

An unauthenticated attacker submits a recipe card entry containing a JavaScript payload embedded in an insufficiently sanitized field - such as a recipe title or ingredient - which the plugin stores or reflects without proper escaping. When a WordPress administrator previews or publishes the recipe page, the malicious script executes in their browser session, silently exfiltrating their authentication cookie to an attacker-controlled endpoint and enabling full administrative account takeover. No public exploit code has been identified, but the low attack complexity and zero authentication requirement make this reproducible by actors with basic web exploitation skills.