Vulnerabilities

Filters

2 selected

11 records

Sort

Vendor: XjSv Component: Cooked Clear all filters

TI-2024-32883 CVE-2024-49290 · GHSA-cfh3-3xc6-pccj

WordPress Cooked Pro plugin < 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1.8.0.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00219 Published 2024-10-20 Fixed in 1.8.0 CWE-352

TI-2024-27859 CVE-2024-41816

WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode

MEDIUM 58

Cooked is a recipe plugin for WordPress.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00381 Published 2024-08-05 Fixed in 1.8.1 CWE-79

TI-2024-26606 CVE-2024-39682

WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt

MEDIUM 64

Cooked is a recipe plugin for WordPress.

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00361 Published 2024-07-17 Fixed in 1.8.0 CWE-116

TI-2024-26605 CVE-2024-39681

WordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All Recipes

HIGH 71

Cooked is a recipe plugin for WordPress.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00414 Published 2024-07-17 Fixed in 1.8.0 CWE-352

TI-2024-26604 CVE-2024-39680

WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save

HIGH 71

Cooked is a recipe plugin for WordPress.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00414 Published 2024-07-17 Fixed in 1.8.0 CWE-352

TI-2024-26603 CVE-2024-39679

WordPress Cooked Plugin - Cross-Site Request Forgery to Recipe Template Reset

HIGH 71

Cooked is a recipe plugin for WordPress.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00426 Published 2024-07-17 Fixed in 1.8.0 CWE-352

TI-2024-26602 CVE-2024-39678

WordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDs

HIGH 71

Cooked is a recipe plugin for WordPress.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00426 Published 2024-07-17 Fixed in 1.8.0 CWE-352

TI-2024-24820 CVE-2024-37308

WordPress Cooked Plugin - Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability

LOW 25

The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sani…

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00426 Published 2024-06-13 Fixed in 1.8.0 CWE-79

TI-2023-23971 CVE-2023-44477 · GHSA-82gw-gpf6-mqwx

WordPress Cooked Plugin <= 1.7.13 is vulnerable to Cross Site Scripting (XSS)

LOW 29

Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Boxy Studio Cooked plugin <= 1.7.13 versions.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00383 Published 2023-10-02 No fix listed CWE-79

TI-2022-03577 CVE-2022-3900 · GHSA-gx5q-2vpf-g2w4

Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection

HIGH 82

The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.18966 Published 2022-12-12 Fixed in 1.7.5.7

TI-2021-06525 CVE-2021-24233 · GHSA-f4qc-2xgh-fg63

Cooked Pro < 1.7.5.6 - Unauthenticated Reflected Cross Site Scripting (XSS)

LOW 31

The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an arbitrary attribute.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.01749 Published 2021-04-22 Fixed in 1.7.5.6 CWE-79