{"id":"CVE-2026-115281","aliases":[],"title":"Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute","titleSource":"WPScan","descriptionSource":"WPScan","products":[{"vendor":"Unknown","name":"Recipe Card Blocks Lite","platforms":[],"versions":[{"version":"3.5.0","status":"affected","lessThan":"3.6.4","versionType":"semver"}],"defaultStatus":"unaffected","source":"WPScan","url":"https://www.cve.org/CVERecord?id=CVE-2026-115281"}],"remediation":[],"description":"The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.","severity":"unknown","score":null,"published":"2026-10-28T06:00:27.397Z","modified":"2026-10-28T17:58:03.936Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://wpscan.com/vulnerability/f358ccee-e664-4a0e-a2b9-d9710c8174ad/"],"sources":[{"name":"CVE","id":"CVE-2026-115281","modified":"2026-10-28T17:58:03.936Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-115281"}],"assessments":[],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T00:30:33.731Z"},"coverage":[{"source":"NVD","status":"available","checkedAt":"2026-10-28T10:20:31.627Z","attemptedAt":"2026-10-28T10:20:31.627Z"},{"source":"GHSA","status":"available","checkedAt":"2026-10-28T10:20:30.951Z","attemptedAt":"2026-10-28T10:20:30.951Z"},{"source":"EUVD","status":"available","checkedAt":"2026-10-28T10:20:30.952Z","attemptedAt":"2026-10-28T10:20:30.952Z"},{"source":"EPSS","status":"no-result","checkedAt":"2026-10-28T10:20:30.952Z","attemptedAt":"2026-10-28T10:20:30.952Z"}],"evidence":[{"source":"GitHub Advisory Database","id":"GHSA-cr7x-4whh-v74w","url":"https://github.com/advisories/GHSA-cr7x-4whh-v74w","modified":"2026-10-28T06:30:33Z","checkedAt":"2026-10-28T10:20:30.951Z"},{"source":"ENISA EUVD","id":"EUVD-2026-111732","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-111732","modified":"Oct 28, 2026, 6:00:27 AM","checkedAt":"2026-10-28T10:20:30.952Z"},{"source":"NVD","id":"CVE-2026-115281","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-115281","modified":"2026-10-28T06:16:35.930","checkedAt":"2026-10-28T10:20:31.627Z"}]}