CVE-2026-115281
Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
CVSS Score
6.8
EPSS Score
0.0%
EPSS Percentile
0th
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.
| Vendor | unknown |
| Product | recipe card blocks lite |
| Published | Oct 28, 2026 |
| Last Updated | Oct 28, 2026 |
Stay Ahead of the Next One
Get instant alerts for unknown recipe card blocks lite
Be the first to know when new medium vulnerabilities affecting unknown recipe card blocks lite are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
Unknown / Recipe Card Blocks Lite
3.5.0 < 3.6.4
References
Credits
Jasper Weijts WPScan