Vulnerabilities

TI-2026-75153 CVE-2026-77829 · GHSA-8442-fc74-434q

Stored cross-site scripting in Cooked plugin for WordPress

LOW 28

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization an…

CVSS 3.1MEDIUM 6.4 Network Low privileges No interaction EPSS 0.00236 Published 2026-10-16 No fix listed CWE-79

TI-2026-51989 CVE-2026-73999 · GHSA-wvpp-85m9-q32r

WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability

LOW 24

Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.

CVSS 3.1MEDIUM 5.4 Network Low privileges No interaction EPSS 0.00287 Published 2026-09-17 No fix listed CWE-639

TI-2025-39137 CVE-2025-62989 · GHSA-gm6f-w7px-9f8g

WordPress Cooked plugin <= 1.11.3 - Cross Site Scripting (XSS) vulnerability

LOW 26

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through <= 1.11.3.

CVSS 3.1MEDIUM 5.9 Network High privileges User interaction EPSS 0.0017 Published 2025-12-31 No fix listed CWE-79

TI-2025-42107 CVE-2025-68586 · GHSA-xccw-jx23-7862

WordPress Cooked plugin <= 1.11.3 - Broken Access Control vulnerability

LOW 30

Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooked: from n/a through <= 1.11.3.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00254 Published 2025-12-24 No fix listed CWE-862

TI-2024-32882 CVE-2024-49289 · GHSA-4wjm-87f9-9842

WordPress Cooked Pro plugin < 1.8.0 - Cross Site Scripting (XSS) vulnerability

LOW 28

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gora Tech LLC Cooked Pro allows Stored XSS.This issue affects Cooked Pro: from n/a before 1.8.0.

CVSS 3.1MEDIUM 6.5 Network Low privileges User interaction EPSS 0.00259 Published 2024-10-17 Fixed in 1.8.0 CWE-79

TI-2024-32884 CVE-2024-49291 · GHSA-6xfc-pfpw-jjvg

WordPress Cooked Pro plugin < 1.8.0 - Unauthenticated Arbitrary File Upload vulnerability

MEDIUM 49

Unrestricted Upload of File with Dangerous Type vulnerability in Gora Tech LLC Cooked Pro.This issue affects Cooked Pro: from n/a before 1.8.0.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00511 Published 2024-10-17 Fixed in 1.8.0 CWE-434