Unscored severity · published Oct 28, 2026
CVE-2026-115281
Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute
New
–
CVSS
–
EPSS
No
On KEV
Description
The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.
Exploitation
Is it being used?
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RC
Recipe Card Blocks Lite ·
3.5.0 before 3.6.4 · source: vendor