Skip to content
Sign in
6.8 Medium

CVE-2026-115281 The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute…

Description

The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.

Affected products and versions

Product Affected versions Fixed in
Recipe Card Blocks Lite 3.5 3.5.0 → < 3.6.4 3.6.4

Other CVEs of Recipe Card Blocks Lite

The 3 CVEs of Recipe Card Blocks Lite →
CVE-2026-115282 The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts… 5.3 Medium CVE-2025-14973 The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a… 6.8 Medium
Track this CVE