Security Alert Summary
The Recipe Card Blocks Lite WordPress plugin contains a stored cross-site scripting (XSS) vulnerability in the steps[].text parameter in versions up to and including 3.7.0. Authenticated users with contributor-level access and above can store script payloads that execute when a visitor, editor, or administrator views the affected content, including via the plugin’s public print endpoint.
CVE Details
- CVE ID: CVE-2026-125948
- Affected component: Recipe Card Blocks Lite plugin for WordPress
- Affected versions: All versions up to and including 3.7.0
- Published: November 13, 2026 at 10:17:28 AM UTC
- Last modified: November 13, 2026 at 10:17:28 AM UTC
- CVSS v3.1: Base Score 6.4 – MEDIUM
- Vector String:
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N - Authentication / privileges / user interaction:
- Attack vector: Network
- Privileges required: Low – requires authenticated contributor-level access or higher
- User interaction: None
- Scope: Changed
- Primary impact:
- Confidentiality: Low
- Integrity: Low
- Availability: None
- Weakness: CWE-79 (Improper Neutralization of Input During Web Page Generation – Cross-site Scripting)
Technical Details
This vulnerability is a stored cross-site scripting issue originating from insufficient input sanitization and output escaping of the block data for recipe steps. The steps[].text attribute can contain HTML and is processed in a way that allows an authenticated contributor to embed event-handler or script payloads that are preserved when a post is saved.
The plugin uses wp_kses_post() during save, and because this function preserves block-delimiter HTML comments verbatim, a contributor can insert payloads inside a block’s steps[].text attribute without needing the unfiltered_html capability. Those payloads are retained in drafts or pending posts and will execute when the post is viewed or when privileged users preview or publish the post. The description also notes execution can occur via the plugin’s public print endpoint.
Impact is limited to script execution in the context of pages that render the injected block content. The vulnerability does not, by the provided data, claim code execution at the server level or direct site takeover, but it does allow client-side script execution that can affect visitors, editors, and administrators who load the affected content.
How This Could Impact Your Website
Consider a site where a site owner manages content, an internal editor reviews drafts, and an external contributor submits recipe content. A contributor with access to create or edit recipe blocks could add a crafted payload into the steps[].text field of a draft or pending post. When an editor or administrator previews or publishes that post, or when a visitor opens the public print view, the embedded script can run in the browser of whoever views the page.
Practical consequences include exposure of information accessible in the browser context (such as saved session tokens or email addresses visible on a page), and an increased risk of targeted phishing or social engineering against staff or administrators if attackers harvest email addresses or other user details. Such client-side script execution can also be used to perform actions in the user interface that rely on the viewer’s privileges.
If you are unsure whether your site is affected or how to assess your current user roles and plugins, it may be worth having a professional review.
Recommended Actions
- Update the affected plugin as soon as a patched version is available.
- Review and reduce unnecessary user roles, especially contributor and author capabilities.
- Enforce strong passwords and enable two-factor authentication for editors and administrators.
- Remove unused or unmaintained plugins that increase your attack surface.
- Monitor site activity and logs for unusual behavior, such as unexpected post content changes, previews, or publishing actions.
If you’d like help reviewing your plugins, user roles, or overall WordPress security posture, our team at Freshy is happy to help.
References
- https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-recipe-card-block.php#L1999
- https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L184
- https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L63
- https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/tags/3.7.0/src/structured-data-blocks/class-wpzoom-steps.php#L90
- https://plugins.trac.wordpress.org/changeset/3794649/recipe-card-blocks-by-wpzoom/trunk/src/structured-data-blocks/class-wpzoom-steps.php
- https://wordpress.org/plugins/recipe-card-blocks-by-wpzoom/#developers
- https://www.wordfence.com/threat-intel/vulnerabilities/id/8ed1f200-d4ae-4c9e-a618-fbeb58c0f3f3?source=cve
