What the vulnerability does
01Description
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Explanation of Vulnerability in Simple Terms
02Summary
Cooked versions before 1.8.1 contain a cross-site scripting (XSS) vulnerability that allows an authenticated attacker to inject malicious scripts. The vulnerability requires user interaction and affects the scope beyond the vulnerable component. An attacker with low-level privileges can inject code that executes in other users' browsers, potentially compromising their sessions or data.
What an attacker can do
03Attacker Capabilities
Inject malicious scripts that execute in other users' browsers when they interact with the affected page.
Potential impact on your site
04Site Impact
Authenticated users' sessions and data can be compromised if they interact with attacker-crafted content.
Conditions required to exploit
05Prerequisites
Attacker must have low-level user account access and the victim must click a link or visit a page containing the malicious payload.
Key dates
06Disclosure timeline
August 5, 2024
CVE published
August 8, 2024
Record updated
