What is the CVSS score of EUVD-2026-35049?

EUVD-2026-35049 has a CVSS 3.1 base score of 6.4 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N. EPSS exploitation probability: 0.0%.

Recipe Card Blocks Lite EUVD-2026-35049

| CVE-2026-3011 MEDIUM

Cross-site Scripting (XSS) (CWE-79)

2026-06-08 Wordfence

GHSA-3hrr-gwwg-4mc5

XSS WordPress

6.4

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.4 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

Low

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jun 08, 2026 - 13:44 vuln.today

CVE Published

Jun 08, 2026 - 11:23 nvd

MEDIUM 6.4

DescriptionCVE.org

The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' attributes in all versions up to, and including, 3.4.13. This is due to the 'WPZOOM_Helpers::deserialize_block_attributes' method converting unicode-encoded sequences back into HTML characters after sanitization has already been applied. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the published post or the print view of an injected recipe.

AnalysisAI

Stored Cross-Site Scripting in WPZOOM's Recipe Card Blocks Lite WordPress plugin (all versions through 3.4.13) allows authenticated attackers with Author-level access or higher to inject persistent malicious scripts into published posts and recipe print views. The vulnerability is a sanitization bypass: the WPZOOM_Helpers::deserialize_block_attributes method re-decodes unicode-escaped character sequences back into raw HTML after WordPress's sanitization pipeline has already run, permitting crafted payloads in the recipe block's 'summary' and 'notes' attributes to survive sanitization and execute in victims' browsers. No public exploit code or CISA KEV listing exists at time of analysis, but the CVSS Changed Scope (S:C) rating reflects cross-user impact, including potential administrator session hijacking.

Technical ContextAI

The affected software is the WPZOOM Recipe Card Blocks Lite WordPress plugin (CPE: cpe:2.3:a:wpzoom:recipe_card_blocks_lite:*:*:*:*:*:*:*:*), a Gutenberg block plugin for publishing recipes. CWE-79 (Improper Neutralization of Input During Web Page Generation - Stored XSS) applies, with the root cause being a post-sanitization deserialization flaw rather than a missing sanitization call. Specifically, WPZOOM_Helpers::deserialize_block_attributes (class-wpzoom-helpers.php:L253) processes block attributes and converts unicode escape sequences (e.g., \u003cscript\u003e) back into their HTML character equivalents after WordPress sanitization routines have completed. Because WordPress sanitization sees only the harmless unicode-escaped form, it passes the content; the dangerous HTML is only materialized afterward. This flaw surfaces in at least three code paths: the print template manager (class-wpzoom-print-template-manager.php:L224) and the structured data block renderer (class-wpzoom-recipe-card-block.php:L582 and L592), meaning both the post view and the standalone print view are injection vectors.

RemediationAI

An upstream fix is confirmed via WordPress plugin repository changeset 3470036 (https://plugins.trac.wordpress.org/changeset/3470036/); administrators should update the Recipe Card Blocks Lite plugin to the version incorporating this changeset - the specific patched release version number is not independently confirmed from available data, so verify the current version in the WordPress plugin directory and confirm it is newer than 3.4.13. If immediate upgrade is not feasible, restrict Author-level and higher roles to fully trusted users only, as this is the minimum access level required for exploitation. As a compensating control, a WAF with WordPress XSS rule sets (such as Wordfence's built-in firewall) can provide partial detection and blocking of unicode-obfuscated payload patterns, though this does not address the root cause and may generate false positives on legitimate unicode content. Administrators should also audit existing recipe posts for unexpected content in 'summary' and 'notes' fields. Disabling the plugin entirely eliminates the attack surface but removes all recipe block functionality.