CVE-2026-3011: Recipe Card Blocks Lite XSS Vulnerability

CVE-2026-3011 Overview

The Recipe Card Blocks Lite plugin for WordPress contains a Stored Cross-Site Scripting (XSS) vulnerability affecting all versions up to and including 3.4.13. The flaw resides in the recipe block's summary and notes attributes. The WPZOOM_Helpers::deserialize_block_attributes method converts unicode-encoded sequences back into HTML characters after sanitization has already been applied, defeating the input filtering. Authenticated attackers with Author-level access or above can inject arbitrary JavaScript that executes when visitors view the published post or its print template. This vulnerability is tracked under CWE-79.

Critical Impact
Authenticated authors can store malicious scripts in recipe posts that execute in the browsers of all viewers, enabling session theft, account takeover, and content defacement.

Affected Products

Recipe Card Blocks Lite (recipe-card-blocks-by-wpzoom) plugin for WordPress
All versions up to and including 3.4.13
WordPress sites permitting Author-level or higher user registration

Discovery Timeline

2026-06-08 - CVE-2026-3011 published to NVD
2026-06-08 - Last updated in NVD database

Technical Details for CVE-2026-3011

Vulnerability Analysis

The vulnerability is a stored XSS issue rooted in flawed attribute handling within the WPZOOM Recipe Card Blocks Lite plugin. WordPress applies output sanitization to block attributes before they are rendered. However, the plugin's helper class performs an additional post-processing step that undoes that protection.

The WPZOOM_Helpers::deserialize_block_attributes method decodes unicode escape sequences such as \\u003c back into raw HTML characters like <. Because this decoding happens after sanitization, an attacker can submit script payloads encoded as unicode escapes that pass through the sanitizer untouched, then re-emerge as executable HTML when the recipe is rendered. The injected scripts execute on both the public post view and the dedicated print template generated by class-wpzoom-print-template-manager.php.

Root Cause

The root cause is sanitizer bypass through post-sanitization decoding. The plugin treats the summary and notes attributes of the recipe block as trusted content after they have been stored, then transforms unicode escapes into HTML. This violates the principle that sanitization must be the final transformation applied before output. See the affected logic in the WordPress Recipe Card Helper Code and the WordPress Structured Data Recipe Class.

Attack Vector

An authenticated attacker with Author-level access creates or edits a post containing a recipe block. The attacker places unicode-escaped JavaScript inside the summary or notes attribute. After publication, any visitor who loads the post or its print view triggers script execution under the site's origin. Exploitation requires no user interaction beyond viewing the page. Refer to the Wordfence Vulnerability Analysis for additional technical detail.

No verified public exploit code is available. The vulnerability mechanism is fully described in the references above.

Detection Methods for CVE-2026-3011

Indicators of Compromise

Recipe posts containing unicode escape sequences such as \\u003cscript or \\u003c/script\\u003e within the summary or notes block attributes.
Unexpected outbound requests from visitor browsers to attacker-controlled domains when loading recipe posts.
New or modified posts authored by low-privilege Author accounts that contain raw <script> tags in rendered HTML.
Anomalous administrative actions following visits to recipe pages, indicating possible session hijacking.

Detection Strategies

Audit wp_posts content for the strings wpzoom-recipe-card/block-recipe-card combined with backslash-u unicode escape patterns inside summary or notes attributes.
Monitor WordPress audit logs for Author-level accounts publishing or updating recipe content at unusual frequency.
Inspect rendered HTML of recipe pages and the /print/ template route for inline <script> blocks that did not originate from theme or plugin code.
Review browser Content Security Policy (CSP) violation reports if a CSP is enforced on the WordPress front end.

Monitoring Recommendations

Enable WordPress audit logging to capture post creation, revision, and user role changes.
Apply network and endpoint telemetry collection to identify post-exploitation activity from compromised administrator sessions.
Track plugin version inventory across WordPress sites to identify hosts still running Recipe Card Blocks Lite 3.4.13 or earlier.

How to Mitigate CVE-2026-3011

Immediate Actions Required

Update the Recipe Card Blocks Lite plugin to the version released in WordPress Plugin Changeset #3470036 or later.
Review all existing recipe posts for unicode-escaped script payloads in the summary and notes attributes and remove malicious content.
Audit Author-level and higher accounts for unauthorized or suspicious users and rotate credentials where compromise is suspected.
Invalidate active administrator sessions to mitigate cookies that may have been exfiltrated by injected scripts.

Patch Information

The vendor addressed the issue in the commit recorded in WordPress Plugin Changeset #3470036. The fix corrects the order of operations in WPZOOM_Helpers::deserialize_block_attributes so that sanitization is applied to the final decoded output rather than the raw stored value. Site administrators should upgrade beyond version 3.4.13.

Workarounds

Temporarily deactivate the Recipe Card Blocks Lite plugin until the patched release is installed.
Restrict the Author role to trusted users only and disable open user registration on affected sites.
Deploy a Web Application Firewall (WAF) rule that blocks block-editor submissions containing unicode-escaped <script> sequences in recipe attributes.
Enforce a strict Content Security Policy that disallows inline script execution on front-end pages.

bash

# Identify sites running affected plugin versions via WP-CLI
wp plugin get recipe-card-blocks-by-wpzoom --field=version

# Update the plugin to the patched release
wp plugin update recipe-card-blocks-by-wpzoom

# Search the database for stored unicode-escaped script payloads
wp db query "SELECT ID, post_title FROM wp_posts \
  WHERE post_content LIKE '%wpzoom-recipe-card%' \
  AND (post_content LIKE '%\\\\\u003cscript%' \
       OR post_content LIKE '%\\\\\u003c/script%');"