CVE-2026-3011 is a stored cross-site scripting vulnerability in the Recipe Card Blocks Lite WordPress plugin (up to version 3.4.13). The issue arises from the 'WPZOOM_Helpers::deserialize_block_attributes' function, which reverses unicode-encoded sequences into HTML characters after input sanitization, enabling injection of arbitrary scripts via the 'summary' and 'notes' attributes of recipe blocks. Exploitation requires authenticated user privileges at Author level or above, and results in script execution in the context of users viewing the affected posts or print views. The vulnerability has a CVSS 3.1 base score of 6.4 (AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N). No known exploits in the wild or vendor patches are currently documented.

An attacker with Author-level or higher privileges can inject malicious scripts into recipe posts that execute in the browsers of users viewing those posts or their print views. This can lead to partial confidentiality and integrity impacts (e.g., theft or manipulation of data accessible in the browser context). Availability is not affected. The vulnerability affects all versions up to and including 3.4.13 of the plugin. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, limit Author-level access to trusted users only and consider disabling or removing the vulnerable plugin if possible. Monitor vendor channels for updates and apply patches promptly once available.