VulnTitan VulnTitan Security command center
Plugin Vulnerability Hub
Plugin 6 known issues Latest disclosed Jan 27, 2026

Recipe Card Blocks Lite Vulnerabilities

Review known vulnerability records for the WordPress plugin Recipe Card Blocks Lite (`recipe-card-blocks-by-wpzoom`), including severity, CVE references, affected versions, and patch status.

Recent tracked CVEs on this page include CVE-2025-14973, CVE-2025-62019 and CVE-2025-26983, so operators can jump from disclosure to patch validation without scanning the full feed first.

View on WordPress.org Back to Feed
Known Records
6
High or Critical
1
Patch Coverage
100%
Last Updated
Jan 27, 2026
Priority CVE Quick Links

Fast paths into Recipe Card Blocks Lite CVE reports

Start with the highest-signal CVE records for this WordPress plugin before scanning the full vulnerability feed.

Indexed CVEs
6
CVE-2025-62019 High 3.4.9
CVE-2025-62019 Recipe Card Blocks Lite Vulnerability

Recipe Card Blocks for Gutenberg & Elementor <= 3.4.8 - Incorrect Authorization

CVE-2025-14973 Medium 3.4.13
CVE-2025-14973 Recipe Card Blocks Lite SQL Injection

Recipe Card Blocks for Gutenberg & Elementor < 3.4.13 - Authenticated (Contributor+) SQL Injection

CVE-2021-24632 Medium 2.8.1
CVE-2021-24632 Recipe Card Blocks Lite Cross-Site Scripting

Recipe Card Blocks by WPZOOM <= 2.8.0 - Reflected Cross-Site Scripting

CVE-2024-43293 Medium 3.3.2
CVE-2024-43293 Recipe Card Blocks Lite Vulnerability

Recipe Card Blocks for Gutenberg & Elementor <= 3.3.1 - Missing Authorization

CVE-2021-24634 Medium 2.8.3
CVE-2021-24634 Recipe Card Blocks Lite Stored Cross-Site Scripting

Recipe Card Blocks by WPZOOM <= 2.8.2 - Authenticated Stored Cross-Site Scripting

CVE-2025-26983 Medium 3.4.4
CVE-2025-26983 Recipe Card Blocks Lite Authorization Bypass

Recipe Card Blocks for Gutenberg & Elementor <= 3.4.3 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Disclosure

Coverage Snapshot

What this page helps you verify fast

This hub clusters every indexed record for Recipe Card Blocks Lite so operators can confirm whether a disclosed issue maps to the installed slug, version range, and patch path.

Patch Visibility
6 records include a published patch path, leaving 0 with no listed safe release yet.
Severity Mix
0 critical and 1 high severity finding.
Recent CVEs
CVE-2025-14973, CVE-2025-62019 and CVE-2025-26983
Reference Workflow
Jump from the hub into the full report when you need remediation notes, exploit context, CVSS vectors, or source references.
Triage First

Open the records most likely to drive action

These recent records surface the CVE strings, patch cues, and direct report links most operators need first.

Known Vulnerabilities

Reports for Recipe Card Blocks Lite

Sorted by latest disclosure date so newly published issues surface first.

Plugin Medium Patched: Yes CVE-2025-14973
CVE-2025-14973: Recipe Card Blocks for Gutenberg & Elementor < 3.4.13 - Authenticated (Contributor+) SQL Injection

The Recipe Card Blocks for Gutenberg & Elementor plugin for WordPress is vulnerable to SQL Injection in versions up to 3.4.13 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authe...

Published
Jan 27, 2026
Patched Release
3.4.13
Affected Versions
Versions before 3.4.13
Next Step
Update to 3.4.13 or newer if supported.
Open CVE-2025-14973 Report Open CVE Reference
Plugin High Patched: Yes CVE-2025-62019
CVE-2025-62019: Recipe Card Blocks for Gutenberg & Elementor <= 3.4.8 - Incorrect Authorization

The Recipe Card Blocks for Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access due to an incorrect capability check on several REST-API endpoints in versions up to, and including, 3.4.8. This makes it possible for unauthenticated attackers to perform u...

Published
Sep 11, 2025
Patched Release
3.4.9
Affected Versions
Versions up to 3.4.8
Next Step
Update to 3.4.9 or newer if supported.
Open CVE-2025-62019 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2025-26983
CVE-2025-26983: Recipe Card Blocks for Gutenberg & Elementor <= 3.4.3 - Insecure Direct Object Reference to Authenticated (Contributor+) Post Disclosure

The Recipe Card Blocks for Gutenberg & Elementor – Best WordPress Recipe Plugin plugin for WordPress is vulnerable to Information Exposure in all versions up to, and including, 3.4.3 via the render() function due to insufficient restrictions on which posts can be included. This m...

Published
Feb 23, 2025
Patched Release
3.4.4
Affected Versions
Versions up to 3.4.3
Next Step
Update to 3.4.4 or newer if supported.
Open CVE-2025-26983 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2024-43293
CVE-2024-43293: Recipe Card Blocks for Gutenberg & Elementor <= 3.3.1 - Missing Authorization

The Recipe Card Blocks for Gutenberg & Elementor plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the search_recipes() and import_recipes() functions in versions up to, and including, 3.3.1. This makes it possible for authenticated at...

Published
Aug 16, 2024
Patched Release
3.3.2
Affected Versions
Versions up to 3.3.1
Next Step
Update to 3.3.2 or newer if supported.
Open CVE-2024-43293 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2021-24634
CVE-2021-24634: Recipe Card Blocks by WPZOOM <= 2.8.2 - Authenticated Stored Cross-Site Scripting

The Recipe Card Blocks by WPZOOM plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.8.2 by not properly sanitizing or escaping some of the properties of the Recipe Card Block (such as ingredientsLayout, iconSet, steps, ingredient...

Published
Aug 24, 2021
Patched Release
2.8.3
Affected Versions
Versions before 2.8.3
Next Step
Update to 2.8.3 or newer if supported.
Open CVE-2021-24634 Report Open CVE Reference
Plugin Medium Patched: Yes CVE-2021-24632
CVE-2021-24632: Recipe Card Blocks by WPZOOM <= 2.8.0 - Reflected Cross-Site Scripting

The Recipe Card Blocks by WPZOOM plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the message parameter in versions up to, and including, 2.8.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers...

Published
Aug 24, 2021
Patched Release
2.8.1
Affected Versions
Versions before 2.8.1
Next Step
Update to 2.8.1 or newer if supported.
Open CVE-2021-24632 Report Open CVE Reference