Cooked

CVE-2026-73999 Sep 17, 13:24 MEDIUM This Month

Authorization bypass in the Cooked WordPress plugin through version 1.16.0 allows an authenticated user holding only Contributor-level privileges to manipulate objects belonging to other users by supplying an unauthorized object identifier. The flaw is remote and requires no victim interaction, but it is gated behind a mandatory low-privilege account, which the independent assessment classifies as a genuine yet moderate-priority authorization defect rather than a critical one. Impact is limited to low integrity and low availability effects with no confidentiality exposure per the assessed vector (CVSS 5.4), and no public exploit code or confirmed active exploitation was identified at time of analysis.

CVE-2024-49290 Oct 20, 11:15 MEDIUM This Month

Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro cooked-pro allows Cross Site Request Forgery.8.0. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2024-41816 Aug 05, 20:15 MEDIUM POC PATCH This Month

Cooked is a recipe plugin for WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2024-39682 Jul 18, 01:15 MEDIUM POC This Month

Cooked is a recipe plugin for WordPress. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-39681 Jul 18, 01:15 HIGH POC This Week

Cooked is a recipe plugin for WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-39680 Jul 18, 01:15 HIGH POC This Week

Cooked is a recipe plugin for WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-39679 Jul 18, 01:15 HIGH POC This Week

Cooked is a recipe plugin for WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-39678 Jul 18, 01:15 HIGH POC This Week

Cooked is a recipe plugin for WordPress. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2024-37308 Jun 13, 14:15 MEDIUM POC PATCH This Month

The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available.

CVE-2023-44477 Oct 02, 09:15 MEDIUM This Month

Auth. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-3900 Dec 12, 18:15 CRITICAL POC THREAT Act Now

The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.

CVE-2021-24233 Apr 22, 21:15 MEDIUM POC This Month

The Cooked Pro WordPress plugin before 1.7.5.6 was affected by unauthenticated reflected Cross-Site Scripting issues, due to improper sanitisation of user input while being output back in pages as an. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.