CVE-2026-73361: Recipe Card Blocks XSS Vulnerability

CVE-2026-73361 Overview

CVE-2026-73361 is an unauthenticated Cross-Site Scripting (XSS) vulnerability affecting the Recipe Card Blocks for Gutenberg & Elementor WordPress plugin in versions up to and including 3.4.18. The flaw falls under [CWE-79], improper neutralization of input during web page generation. Attackers can inject malicious script content that executes in the browsers of users viewing affected pages. Exploitation requires user interaction but no authentication, expanding the attackable population to any visitor of a vulnerable site. The vulnerability affects confidentiality, integrity, and availability at a limited scope with a changed security scope, meaning injected scripts can impact resources beyond the vulnerable component.

Critical Impact

Unauthenticated attackers can inject arbitrary JavaScript into WordPress sites running Recipe Card Blocks <= 3.4.18, enabling session hijacking, credential theft, and administrative account takeover through victim interaction.

Affected Products

• Recipe Card Blocks for Gutenberg & Elementor plugin by WPZOOM
• All versions up to and including 3.4.18
• WordPress sites with the plugin installed and activated

Discovery Timeline

• 2026-08-18 - CVE-2026-73361 published to NVD
• 2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-73361

Vulnerability Analysis

The vulnerability is a stored or reflected Cross-Site Scripting (XSS) flaw in the Recipe Card Blocks for Gutenberg & Elementor plugin. The plugin fails to properly sanitize or escape user-supplied input before rendering it in HTML output. An unauthenticated attacker can supply crafted input containing JavaScript payloads through plugin-exposed parameters. When a victim loads a page rendering that input, the browser executes the injected script in the context of the site's origin.

The scope change in the impact metrics indicates the injected payload can affect resources beyond the plugin itself, such as the WordPress administrative session or other authenticated user contexts. This aligns with typical XSS exploitation, where attacker scripts leverage the DOM and cookies of the hosting origin.

The EPSS probability is 0.18%, reflecting low observed exploitation activity at publication. However, WordPress plugin XSS flaws are routinely weaponized in bulk against unpatched sites once details become public.

Root Cause

The root cause is missing output encoding and input validation in the plugin's request handling logic. User-supplied data reaches HTML rendering paths without passing through WordPress escaping functions such as esc_html(), esc_attr(), or wp_kses(). This omission allows raw HTML and JavaScript to persist through the render pipeline.

Attack Vector

An attacker crafts a URL or request containing a JavaScript payload targeting a vulnerable plugin endpoint. The attacker delivers the URL to a victim through phishing, forum posts, or social engineering. When the victim clicks the link or loads the affected page, the payload executes in the victim's browser under the site's origin. Because the vulnerability requires no authentication to trigger, any anonymous request can plant or deliver the payload. See the Patchstack advisory for additional technical detail.

Detection Methods for CVE-2026-73361

Indicators of Compromise

• Unexpected <script>, onerror=, onload=, or javascript: strings in Recipe Card Blocks post content or plugin database tables
• Outbound requests from user browsers to unfamiliar domains after loading recipe pages
• New administrative WordPress accounts or modified user roles without corresponding admin activity
• Anomalous session cookie access patterns or authenticated actions from unusual IP addresses

Detection Strategies

• Inspect the plugin's stored content in wp_posts and plugin-specific tables for HTML tags and event handler attributes
• Deploy Web Application Firewall (WAF) rules that flag XSS payload patterns targeting plugin endpoints
• Review web server access logs for requests containing URL-encoded script tags against paths referencing recipe blocks

Monitoring Recommendations

• Continuously monitor WordPress plugin inventory and version state across managed sites
• Alert on newly created administrator accounts and role escalations
• Correlate anomalous browser telemetry with recent page loads to identify client-side compromise

How to Mitigate CVE-2026-73361

Immediate Actions Required

• Update Recipe Card Blocks for Gutenberg & Elementor to a version above 3.4.18 as soon as a fixed release is available from WPZOOM
• Audit existing recipe posts and plugin data stores for injected scripts and remove malicious content
• Rotate credentials and invalidate active sessions for administrators who accessed affected pages

Patch Information

Refer to the Patchstack advisory for CVE-2026-73361 for the latest fixed version guidance and vendor remediation status. Apply the vendor patch through the WordPress plugin update mechanism once released.

Workarounds

• Deactivate and remove the Recipe Card Blocks plugin until a patched version is applied
• Deploy a virtual patch through a Web Application Firewall to block XSS payloads targeting plugin routes
• Enforce a strict Content Security Policy (CSP) that disallows inline script execution and restricts script sources

# Content-Security-Policy header example to mitigate XSS execution
Header set Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'"