Cooked Recipe Management
Monthly
Stored cross-site scripting in the Cooked - Recipe Management plugin for WordPress (all versions up to and including 1.16.1) lets an authenticated attacker with contributor-level access or above embed arbitrary JavaScript through the [cooked-timer] shortcode, which is stored and then executed in the browser of any user - including an administrator - who later views the injected post, page, or recipe. The root cause is insufficient input sanitization and output escaping in the plugin's shortcode handling (CWE-79), and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N places it at 6.4, a moderate-severity issue contingent on the attacker already holding a contributor+ account on a site running the vulnerable plugin. There is confirmed actively exploited status? No - no public exploit identified at time of analysis, and no CISA KEV listing; treat this as a routine patch-management priority rather than an emergency.
Stored cross-site scripting in the Cooked - Recipe Management plugin for WordPress (all versions up to and including 1.16.1) lets an authenticated attacker with contributor-level access or above embed arbitrary JavaScript through the [cooked-timer] shortcode, which is stored and then executed in the browser of any user - including an administrator - who later views the injected post, page, or recipe. The root cause is insufficient input sanitization and output escaping in the plugin's shortcode handling (CWE-79), and the CVSS 3.1 vector AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N places it at 6.4, a moderate-severity issue contingent on the attacker already holding a contributor+ account on a site running the vulnerable plugin. There is confirmed actively exploited status? No - no public exploit identified at time of analysis, and no CISA KEV listing; treat this as a routine patch-management priority rather than an emergency.