2 lines
3.5 KiB
JSON
2 lines
3.5 KiB
JSON
{"affected":[{"affectedData":[{"defaultStatus":"unaffected","product":"Recipe Card Blocks Lite","vendor":"wpzoom","versions":[{"lessThanOrEqual":"3.4.13","status":"affected","version":"0","versionType":"semver"}]}],"source":"security@wordfence.com"}],"cveTags":[],"descriptions":[{"lang":"en","value":"The Recipe Card Blocks Lite plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the recipe block's 'summary' and 'notes' attributes in all versions up to, and including, 3.4.13. This is due to the 'WPZOOM_Helpers::deserialize_block_attributes' method converting unicode-encoded sequences back into HTML characters after sanitization has already been applied. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that execute whenever a user accesses the published post or the print view of an injected recipe."},{"lang":"es","value":"El plugin Recipe Card Blocks Lite para WordPress es vulnerable a cross-site scripting almacenado a través de los atributos 'summary' y 'notes' del bloque de recetas en todas las versiones hasta la 3.4.13, inclusive. Esto se debe a que el método 'WPZOOM_Helpers::deserialize_block_attributes' convierte secuencias codificadas en Unicode de nuevo en caracteres HTML después de que ya se haya aplicado la sanitización. Esto hace posible que atacantes autenticados, con acceso de nivel de Autor y superior, inyecten scripts web arbitrarios en páginas que se ejecutan cada vez que un usuario accede a la publicación publicada o a la vista de impresión de una receta inyectada."}],"id":"CVE-2026-3011","lastModified":"2026-07-23T07:10:00.113","metrics":{"cvssMetricV31":[{"cvssData":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.4,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"LOW","scope":"CHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N","version":"3.1"},"exploitabilityScore":3.1,"impactScore":2.7,"source":"security@wordfence.com","type":"Secondary"}],"ssvcV203":[{"source":"134c704f-9b21-4f2e-91b3-4a467353bcc0","ssvcData":{"id":"CVE-2026-3011","options":[{"exploitation":"none"},{"automatable":"no"},{"technicalImpact":"partial"}],"role":"CISA Coordinator","timestamp":"2026-06-08T12:41:37.644408Z","version":"2.0.3"}}]},"published":"2026-06-08T12:16:31.867","references":[{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/classes/class-wpzoom-helpers.php#L253"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/classes/class-wpzoom-print-template-manager.php#L224"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/structured-data-blocks/class-wpzoom-recipe-card-block.php#L582"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/browser/recipe-card-blocks-by-wpzoom/trunk/src/structured-data-blocks/class-wpzoom-recipe-card-block.php#L592"},{"source":"security@wordfence.com","url":"https://plugins.trac.wordpress.org/changeset/3470036/"},{"source":"security@wordfence.com","url":"https://www.wordfence.com/threat-intel/vulnerabilities/id/a684bf5f-7cf6-43b1-b457-fdc2ba74852d?source=cve"}],"sourceIdentifier":"security@wordfence.com","vulnStatus":"Deferred","weaknesses":[{"description":[{"lang":"en","value":"CWE-79"}],"source":"security@wordfence.com","type":"Secondary"}]}
|