TI-2024-26266 Aliases CVE-2024-39310

WordPress Basil Theme Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability

MEDIUM 58CWE-79Published 2024-07-01 · Updated 2024-08-02

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

The Basil recipe theme for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `post_title` parameter in versions up to, and including, 2.0.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. Because the of the default WordPress validation, it is not possible to insert the payload directly but if the Cooked plugin is installed, it is possible to create a recipe post type (cp_recipe) and inject the payload in the title field. Version 2.0.5 contains a patch for the issue.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00298 22nd percentileScored 2026-11-07

Fix Fixed Basil (XjSv): 2.0.5

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
XjSv	Basil	before 2.0.5	2.0.5	Patch available	CNA

Basil VendorXjSv Affected before 2.0.5 Fixed in 2.0.5 Patch available CNA

CPE names CISA-ADP · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:xjsv:basil::::::::	—	—	—

cpe:2.3:a:xjsv:basil:*:*:*:*:*:*:*:* Versions — — ·—

Remediation

Fix · CNA Basil (XjSv) Fixed in 2.0.5

Timeline

2026-10-02 Threatist record created from CVE-2024-39310

References

Other 2

TI-2022-03577 Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
TI-2024-26605 WordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All Recipes CVSS 3.1HIGH 8.8
TI-2024-26604 WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save CVSS 3.1HIGH 8.8
TI-2024-26603 WordPress Cooked Plugin - Cross-Site Request Forgery to Recipe Template Reset CVSS 3.1HIGH 8.8
TI-2024-26602 WordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDs CVSS 3.1HIGH 8.8
TI-2024-26606 WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt CVSS 3.1MEDIUM 6.4

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences