CVE-2021-24632: Recipe Card Blocks < 2.8.1 - Reflected Cross-Site Scripting

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2021-09-27 · updated 2026-06-17
Weakness: CWE-79

Description

The Recipe Card Blocks by WPZOOM WordPress plugin before 2.8.1 does not escape the message parameter before outputting it back in the admin dashboard, leading to a Reflected Cross-Site Scripting issue

Affected products

WPZOOM Recipe Card Blocks for Gutenberg & Elementor: before 2.8.1 — fixed in 2.8.1

How to fix

Upgrade to a fixed version: WPZOOM Recipe Card Blocks for Gutenberg & Elementor 2.8.1. Check the vendor advisory for mitigations.

References

https://wpscan.com/vulnerability/55cd6d5e-92c1-407a-8c0f-f89d415ebb66
https://wpscan.com/vulnerability/55cd6d5e-92c1-407a-8c0f-f89d415ebb66

Get alerted when CVE-2021-24632 or the next vulnerability affects your stack