Cooked Recipe Management CVE-2026-77829

Exploitation requires an authenticated WordPress account with contributor-level privileges or above (per CVSS PR:L) on a site where the Cooked - Recipe Management plugin (version ≤ 1.16.1) is installed and active, and the ability to embed the [cooked-timer] shortcode within post/page/recipe content. The payload is stored and fires when any user - most impactfully an administrator - subsequently views the injected page. Limiting factors: the attacker must already possess a contributor+ account (not available to anonymous visitors unless the site permits low-trust author registration), the vulnerable plugin must be present, and successful high-impact abuse depends on a privileged user actually visiting the injected page.

This is a moderate-severity stored XSS (CVSS 6.4, CWE-79) that should be treated as a routine patch-management priority rather than an emergency. The CVSS vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N indicates network-reachable, low-complexity exploitation but explicitly requires PR:L - authenticated access at contributor level or above - which is the single largest limiting factor and rules out anonymous mass exploitation. The scope change (S:C) correctly reflects that injected script executes in the browser of a different user (e.g., an administrator viewing the page), but impact is capped at Low for both confidentiality and integrity with no availability impact. There is no EPSS score, no CISA KEV listing, and no public proof-of-concept in the provided data, so there is no evidence of active or widespread exploitation - the risk is latent and contingent on an attacker already holding a low-privilege account. No signals conflict here; rather, key exploitation-likelihood data (EPSS, POC) is simply ABSENT, so probability cannot be quantified. Net: a real but bounded issue, driven by the contributor-access precondition, not a high-urgency internet-wide threat.

An attacker who holds (or registers/acquires) a WordPress account with contributor-level privileges or higher on a site running the Cooked plugin crafts a page or recipe containing a malicious [cooked-timer] shortcode whose content carries an unsanitized script payload. When an administrator or other user later views that page, the script executes in their authenticated browser session, enabling actions such as session/cookie theft or admin-context operations. No public exploit code is identified in the available data, and the required contributor account limits this to insiders or sites allowing low-trust author registration.