EUVD-2026-60785
GHSA-68j3-3mmr-fp5p
Severity by source
AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
XSS via network requires no privileges and changes scope to victim browser; availability impact removed as XSS does not typically disrupt service availability.
Primary rating from Vendor (Patchstack).
CVSS VectorVendor: Patchstack
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Lifecycle Timeline
2DescriptionCVE.org
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
AnalysisAI
Cross-Site Scripting in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18 allows unauthenticated remote attackers to inject malicious scripts that execute in victims' browsers when they view affected recipe content. Reported by Patchstack and registered as EUVD-2026-60785, the vulnerability carries a CVSS 7.1 (High) score with a scope change indicating the injected script breaks out of the plugin's trust boundary into the broader browser context. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires that the target WordPress site runs the Recipe Card Blocks for Gutenberg & Elementor plugin at version 3.4.18 or earlier and that at least one plugin-rendered recipe card page is accessible and viewable by an authenticated user (UI:R). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 7.1 is primarily driven by the network attack vector, zero authentication requirement (PR:N), and scope change (S:C), which together lower the barrier to initial injection significantly. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An unauthenticated attacker submits a recipe card entry containing a JavaScript payload embedded in an insufficiently sanitized field - such as a recipe title or ingredient - which the plugin stores or reflects without proper escaping. When a WordPress administrator previews or publishes the recipe page, the malicious script executes in their browser session, silently exfiltrating their authentication cookie to an attacker-controlled endpoint and enabling full administrative account takeover. … |
| Remediation | Update the Recipe Card Blocks for Gutenberg & Elementor plugin to a version beyond 3.4.18 immediately by checking the WordPress plugin repository or the Patchstack advisory at https://patchstack.com/database/wordpress/plugin/recipe-card-blocks-by-wpzoom/vulnerability/wordpress-recipe-card-blocks-for-gutenberg-elementor-plugin-3-4-18-cross-site-scripting-xss-vulnerability - the exact patched release version is not confirmed in available data, so the plugin changelog must be reviewed directly. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit all WordPress installations to identify those using WPZOOM Recipe Card Blocks through version 3.4.18 and document plugin dependencies and content relying on it. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting i
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properti
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly
Same weakness CWE-79 – Cross-site Scripting (XSS)
View allShare
External POC / Exploit Code
Leaving vuln.today