CVE-2024-39682: medium-severity vulnerability in XjSv Cooked
WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 6.4epss 0.4%
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary HTML in pages that will be shown whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
Affected products
XjSv · CookedRelated CVEs — XjSv Cooked
In the same product, most dangerous first.
CVE-2024-39679MEDIUMWordPress Cooked Plugin - Cross-Site Request Forgery to Recipe Template ResetEPSS 0.4%CVE-2024-39678MEDIUMWordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDsEPSS 0.4%CVE-2024-37308MEDIUMWordPress Cooked Plugin - Authenticated (Contributor+) Persistent Cross-Site Scripting VulnerabilityEPSS 0.4%CVE-2024-39681MEDIUMWordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All RecipesEPSS 0.4%CVE-2024-39680MEDIUMWordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template SaveEPSS 0.4%CVE-2024-41816MEDIUMWordPress Cooked Plugin Persistent Cross-Site Scripting via ShortcodeEPSS 0.4%