Live › vulnerability › CVE-2026-115281
Go to dashboardThe Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize block and shortcode attributes before putting them into SQL queries. An authenticated user with Contributor access or higher can run SQL injection and read or change site database content.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 06:31 UTC. All times on this page are UTC.
Sites running Recipe Card Blocks Lite before 3.6.4 are exposed. The attack needs a logged-in account with Contributor access or above, so sites where only trusted editors can log in carry less risk. Sites that do not use the plugin can skip it.
No product ranges from the sources yet.
wp plugin get recipe-card-blocks-lite --field=version3.6.4 or laterEach row is the first time that source carried this signal. The analyst’s rows are its own findings.
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.
This page as .md · .json · in your agent: get_signal("CVE-2026-115281")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.