Description

Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-18T15:17:04.503Z",
  "pubdate": "2026-08-18T15:17:04.503Z",
  "executiveSummary": "An unauthenticated Cross-Site Scripting (XSS) vulnerability has been identified in the Recipe Card Blocks for Gutenberg & Elementor plugin, affecting all versions up to and including 3.4.18. This security flaw enables remote attackers to inject malicious scripts, typically JavaScript, into vulnerable input fields or parameters processed and rendered by the plugin. The primary impact of this vulnerability includes potential session hijacking, arbitrary redirection, defacement, and the execution of unauthorized actions within the context of a victim's browser session. The affected systems comprise WordPress installations utilizing the specified vulnerable versions of the Recipe Card Blocks plugin. The risk implications are severe, as exploitation requires zero authentication, lowering the attack barrier to entry and allowing any external unauthenticated threat actor to target site visitors or administrative users interacting with the rendered recipe components. Exploitation relies on the lack of proper input sanitization and output encoding within the vulnerable software components, allowing arbitrary script payloads to persist or reflect depending on the exact injection vector. Remediation requires updating the plugin beyond the affected version range once a patched release is made available by the vendor.",
  "technicalDetails": "The vulnerability stems from insufficient input sanitization and output escaping within the Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18. Specifically, user-supplied data handled by the plugin's rendering functions or input parameters is processed and output directly into the Document Object Model (DOM) without proper context-aware escaping. Because the flaw is unauthenticated, an attacker does not require any prior privileges, valid user accounts, or session tokens to interact with the target application's attack surface. The network exposure is remote, as the vulnerable endpoints are accessible via standard HTTP/HTTPS requests exposed by the WordPress site. The attack flow begins when an unauthenticated threat actor crafts a malicious payload containing executable JavaScript encapsulated within HTML tags or event handlers. This payload is injected into vulnerable parameters processed by the plugin. When a victim, which may include high-privileged administrators or standard site visitors, loads the affected page containing the rendered recipe block, the browser parses the unmitigated input and executes the injected script within the security context of the victim's session. The payload behavior can range from stealing sensitive session cookies and authorization tokens via document.cookie to performing unauthorized state-changing requests on behalf of the authenticated user through asynchronous JavaScript requests (AJAX/Fetch API). Post-exploitation impact heavily depends on the privileges of the victim interacting with the malicious payload; if an administrator views the compromised page, the attacker could potentially inject malicious administrative scripts to create new administrative accounts, modify plugin files, or achieve remote code execution depending on secondary WordPress capabilities. The root cause is the failure to implement rigorous validation routines and secure output encoding functions such as esc_html(), esc_attr(), or wp_kses() prior to rendering dynamic data fields within the Gutenberg blocks and Elementor widgets provided by the plugin."
}