TI-2024-27859 Aliases CVE-2024-41816

WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode

MEDIUM 58CWE-79Published 2024-08-05 · Updated 2024-08-08

Key facts

Attack vector: Network
Privileges required: Low
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.00381 32nd percentileScored 2026-11-07

Public exploit Yes 1 exploit referenceTagged by NVD

Fix Fixed Cooked (XjSv): 1.8.1

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
XjSv	Cooked	before 1.8.1	1.8.1	Patch available	CNA

Cooked VendorXjSv Affected before 1.8.1 Fixed in 1.8.1 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:boxystudio:cooked:::::pro:wordpress::	before 1.8.1	Vulnerable	XjSv

cpe:2.3:a:boxystudio:cooked:*:*:*:*:pro:wordpress:*:* Versions before 1.8.1 Vulnerable ·XjSv

Remediation

Fix · CNA Cooked (XjSv) Fixed in 1.8.1

Timeline

2026-10-02 Threatist record created from CVE-2024-41816

References

Exploit 1

https://github.com/XjSv/Cooked/security/advisories/GHSA-3gw3-2qjq-xqjj

Patch 1

https://github.com/XjSv/Cooked/commit/ac7455bdccc99fb2f5b3c7611312947c1623c3ec

TI-2022-03577 Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection CVSS 3.1CRITICAL 9.8
TI-2024-26605 WordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All Recipes CVSS 3.1HIGH 8.8
TI-2024-26604 WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save CVSS 3.1HIGH 8.8
TI-2024-26603 WordPress Cooked Plugin - Cross-Site Request Forgery to Recipe Template Reset CVSS 3.1HIGH 8.8
TI-2024-26602 WordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDs CVSS 3.1HIGH 8.8
TI-2024-26606 WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt CVSS 3.1MEDIUM 6.4

See all 10 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences