CVE-2024-37308: falha de média gravidade em XjSv Cooked
WordPress Cooked Plugin - Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
13Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 5.4epss 0.4%
The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. A patch is available at commit 8cf88f334ccbf11134080bbb655c66f1cfe77026 and will be part of version 1.8.0.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Produtos afetados
XjSv · CookedCVEs relacionadas — XjSv Cooked
No mesmo produto, das mais perigosas para as menos.
CVE-2024-39679MEDIUMWordPress Cooked Plugin - Cross-Site Request Forgery to Recipe Template ResetEPSS 0.4%CVE-2024-39678MEDIUMWordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDsEPSS 0.4%CVE-2024-39681MEDIUMWordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All RecipesEPSS 0.4%CVE-2024-39680MEDIUMWordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template SaveEPSS 0.4%CVE-2024-41816MEDIUMWordPress Cooked Plugin Persistent Cross-Site Scripting via ShortcodeEPSS 0.4%CVE-2024-39682MEDIUMWordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe ExcerptEPSS 0.4%