CVE-2026-73361: WordPress Recipe Card Blocks for Gutenberg & Elementor plugin <= 3.4.18 - Cross Site Scripting (XSS) vulnerability
Published Aug 18, 2026
·Updated
Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.
Affected Software
1 affected component
WordPress Recipe Card Blocks for Gutenberg & Elementor<=3.4.18
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WordPress Recipe Card Blocks for Gutenberg & Elementorto a version that resolves this vulnerability.Fixed in 3.4.19
Event History
Aug 18, 2026
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
RemedyDescriptionSeverityWeakness
Frequently Asked Questions
1
Which installations should be considered exposed?
Sites using Recipe Card Blocks for Gutenberg & Elementor version 3.4.18 or earlier are affected according to the available information.
2
What access does an attacker need to exploit this issue?
The vulnerability is unauthenticated, so an attacker does not need a WordPress account or other prior privileges. Exploitation does require user interaction, as reflected by the UI:R vector.