Free tool
Is my WordPress plugin safe?
Type a plugin or theme and the version you run, and we’ll show every known vulnerability that affects it, from the 390,080 records in our vulnerability database. The version is listed under Plugins in your WordPress dashboard.
Plugin · recipe-card-blocks-by-wpzoom
Recipe Card Blocks Lite
8 known vulnerabilities on record. Add your version above to see which ones affect you.
Oct 29, 2026Recipe Card Blocks Lite: Does not perform an authorization check before rendering posts through its recipe print featureCVE-2026-115282 · fixed in 3.6.4 · reported by WPScan
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not perform an authorization check before rendering posts through its recipe print feature, allowing unauthenticated users to disclose the title, ID and recipe content of unpublished posts, including drafts, pending, private and password-protected posts, that contain a recipe card block. Its optional "print only published posts" protection does not prevent this, because the status check is applied to a different post than the one ultimately rendered.
Oct 28, 2026Recipe Card Blocks Lite: Does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queriesCVE-2026-115281 · fixed in 3.6.4 · reported by WPScanMedium 6.8
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.
Aug 18, 2026Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.CVE-2026-73361 · affects up to 3.4.18 · reported by PatchstackHigh 7.1
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
Jun 8, 2026Recipe Card Blocks Lite: Stored Cross-Site ScriptingCVE-2026-3011 · affects up to 3.4.13 · reported by WordfenceMedium 6.4
The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' attributes in all versions up to, and including, 3.4.13. This is due to the 'WPZOOM_Helpers::deserialize_block_attributes' method converting unicode-encoded sequences back into HTML characters after sanitization has already been applied. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the published post or the print view of an injected recipe.
NVD recordplugins.trac.wordpress.orgplugins.trac.wordpress.org
Jan 26, 2026Recipe Card Blocks Lite: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2025-14973 · fixed in 3.4.13 · reported by WPScanMedium 6.8
The Recipe Card Blocks Lite WordPress plugin before 3.4.13 does not sanitize and escape a parameter before using it in a SQL statement, allowing contributors and above to perform SQL injection attacks.
Oct 22, 2025Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2025-62019 · affects up to 3.4.8 · reported by PatchstackMedium 6.5
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.8.
Feb 25, 2025Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2025-26983 · affects up to 3.4.3 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor recipe-card-blocks-by-wpzoom allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through <= 3.4.3.
Nov 1, 2024Recipe Card Blocks for Gutenberg & Elementor: Missing AuthorizationCVE-2024-43293 · affects up to 3.3.1 · reported by PatchstackMedium 4.3
Missing Authorization vulnerability in WPZOOM Recipe Card Blocks for Gutenberg & Elementor allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Recipe Card Blocks for Gutenberg & Elementor: from n/a through 3.3.1.
Versions are matched against the affected ranges published with each record. A plugin can ship a fix under its own numbering, so if something looks off, check the linked record. Want the whole site checked at once? Run the free website check.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.