What the vulnerability does
01Description
The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. A patch is available at commit 8cf88f334ccbf11134080bbb655c66f1cfe77026 and will be part of version 1.8.0.
Explanation of Vulnerability in Simple Terms
02Summary
Cooked versions before 1.8.0 contain a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction and affects the scope beyond the vulnerable component. An attacker with low privileges can craft a malicious link or page that, when visited by a site user, executes arbitrary JavaScript in their browser session.
What an attacker can do
03Attacker Capabilities
Inject malicious JavaScript that runs in other users' browsers when they visit a crafted page.
Potential impact on your site
04Site Impact
Authenticated users' sessions and data can be compromised if they interact with attacker-controlled content.
Conditions required to exploit
05Prerequisites
Attacker must have a low-privilege account; victim must click a malicious link or visit a crafted page.
Key dates
06Disclosure timeline
June 13, 2024
CVE published
August 2, 2024
Record updated
