CVE-2024-39682CWE-116

WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt

Medium · published July 17, 2024

CVSS v3.1
6.4
EPSS
0%
Percentile
28.7
In the wild
Unconfirmed
What it is

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary HTML in pages that will be shown whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.00361 · 28.7th percentile
Weakness
CWE-116 · Improper Encoding or Escaping of Output
Published
2024-07-17T23:47Z
EPSS history
Timeline
  • 17 JUL 23:47Z
    WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt
    cvelistv5