Unauthenticated XSS in Recipe Card Blocks for Gutenberg & Elementor

Executive Summary

CVE-2026-73361 is an Unauthenticated Cross Site Scripting (XSS) vulnerability affecting Recipe Card Blocks for Gutenberg & Elementor plugin versions 3.4.18 and below. It allows attackers to inject malicious scripts into websites without authentication.

Useful 0 Not Useful 0

Detection Guidance

Detecting this XSS vulnerability requires checking if the Recipe Card Blocks for Gutenberg & Elementor plugin is installed and if it is running a vulnerable version (<= 3.4.18). Inspect your WordPress plugins directory for the plugin folder and check the version in the plugin's main file. No specific commands are provided, but monitoring for unusual script injections or user reports of malicious activity may indicate exploitation.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to execute unauthorized actions like redirects or HTML execution when users visit the site. It requires user interaction such as clicking a malicious link. Attackers may target privileged users and exploit it in mass campaigns.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Recipe Card Blocks for Gutenberg & Elementor plugin to version 3.4.19 or later. If an update is not immediately available, apply Patchstack's provided mitigation rule to block attacks until the update is applied. Remove or disable the plugin if no update is possible.

Useful 0 Not Useful 0