{"id":"CVE-2026-115281","revision":"606373b87d864afab4df58cf51c7f4f4","records":[{"revision":"606373b87d864afab4df58cf51c7f4f4","observedAt":"2026-10-28T07:06:08.469+00:00","statement":{"source":"cve-program","id":"CVE-2026-115281","aliases":[],"title":"Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute","description":"The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.","state":0,"publishedAt":"2026-10-28T06:00:27.397+00:00","modifiedAt":"2026-10-28T06:00:27.397+00:00","affected":[{"ecosystem":"Vendor product","name":"Recipe Card Blocks Lite","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Recipe Card Blocks Lite\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"3.5.0\",\n                            \"lessThan\": \"3.6.4\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/f358ccee-e664-4a0e-a2b9-d9710c8174ad/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115281","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115281","identifiers":["CVE-2026-115281"]},"retained":false,"historicalAffected":[]}],"coverage":[]}