{"id":"CVE-2026-115281","revision":"89d55617cdd84eba9b230f22ef9fec48","records":[{"revision":"89d55617cdd84eba9b230f22ef9fec48","observedAt":"2026-10-28T18:46:48.818+00:00","statement":{"source":"cve-program","id":"CVE-2026-115281","aliases":[],"title":"Recipe Card Blocks 3.5.0 - 3.6.3 - Contributor+ SQLi via 'recipeId' Attribute","description":"The Recipe Card Blocks Lite WordPress plugin before 3.6.4 does not sanitize and cast a block and shortcode attribute before concatenating it into SQL queries, allowing authenticated users with Contributor-level access or above to perform SQL injection attacks.","state":0,"publishedAt":"2026-10-28T06:00:27.397+00:00","modifiedAt":"2026-10-28T17:58:03.936+00:00","affected":[{"ecosystem":"Vendor product","name":"Recipe Card Blocks Lite","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Unknown\",\n                    \"product\": \"Recipe Card Blocks Lite\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"versionType\": \"semver\",\n                            \"version\": \"3.5.0\",\n                            \"lessThan\": \"3.6.4\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[],"references":["https://wpscan.com/vulnerability/f358ccee-e664-4a0e-a2b9-d9710c8174ad/"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-115281","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-115281","identifiers":["CVE-2026-115281"]},"retained":false,"historicalAffected":[]}],"coverage":[]}