Recipe Card Blocks For Gutenberg Elementor
Monthly
Cross-Site Scripting in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18 allows unauthenticated remote attackers to inject malicious scripts that execute in victims' browsers when they view affected recipe content. Reported by Patchstack and registered as EUVD-2026-60785, the vulnerability carries a CVSS 7.1 (High) score with a scope change indicating the injected script breaks out of the plugin's trust boundary into the broader browser context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.3.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-Site Scripting in the WPZOOM Recipe Card Blocks for Gutenberg & Elementor WordPress plugin through version 3.4.18 allows unauthenticated remote attackers to inject malicious scripts that execute in victims' browsers when they view affected recipe content. Reported by Patchstack and registered as EUVD-2026-60785, the vulnerability carries a CVSS 7.1 (High) score with a scope change indicating the injected script breaks out of the plugin's trust boundary into the broader browser context. No public exploit code and no CISA KEV listing have been identified at time of analysis.
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.3.1. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.3 does not properly sanitise or escape some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps,. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.