The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP…
CVSS 3.1CRITICAL 9.8·Network·No auth·No interaction·EPSS 0.18966·Published 2022-12-12·Fixed in 1.7.5.7
The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escapin…
CVSS 3.1MEDIUM 5.4·Network·Low privileges·User interaction·EPSS 0.00298·Published 2024-07-01·Fixed in 2.0.5CWE-79
Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1.8.0.
CVSS 3.1HIGH 8.8·Network·No auth·User interaction·EPSS 0.00219·Published 2024-10-20·Fixed in 1.8.0CWE-352
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: fro…
CVSS 3.1HIGH 7.5·Network·No auth·No interaction·EPSS 0.00531·Published 2023-12-28·Fixed in 2.4.4CWE-200
The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.
CVSS 3.1MEDIUM 6.1·Network·No auth·User interaction·EPSS 0.01749·Published 2021-04-22·Fixed in 1.7.5.6CWE-79
The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sani…
CVSS 3.1MEDIUM 5.4·Network·Low privileges·User interaction·EPSS 0.00426·Published 2024-06-13·Fixed in 1.8.0CWE-79
THREATIST.IORead the docs