Approved changes feed: RSS · Atom
cpe:2.3:a:boxystudio:cooked:*:*:*:*:pro:wordpress:*:*part: a version: * update: *
| Vendor | Boxystudio (e909dc9c-3e7f-559e-97e9-706bc0afb9fd) |
|---|---|
| Product | Cooked (289a879f-55c0-55bb-9cbd-768ddf05ed29) |
| Edition | * |
| Language | * |
| Software edition | pro |
| Target software | wordpress |
| Target hardware | * |
| Other | * |
Notes
Imported from gcve-enriched-dumps CVE data
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-49290 |
vulnerable | 2026-06-08 06:50:13.372784 |
WordPress Cooked Pro plugin < 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability
MEDIUM (4.3)
Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1.8.0.
Published: 2024-10-20T10:14:57.772Z
Updated: 2026-04-28T16:10:24.819Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-41816 |
vulnerable | 2026-06-08 06:43:55.269552 |
WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode
MEDIUM (5.4)
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2024-08-05T20:12:41.428Z
Updated: 2024-08-08T13:28:33.622Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39682 |
vulnerable | 2026-06-08 06:41:51.383635 |
WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt
MEDIUM (6.4)
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary HTML in pages that will be shown whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2024-07-17T23:47:56.165Z
Updated: 2024-08-02T04:26:16.019Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39681 |
vulnerable | 2026-06-08 06:41:51.383275 |
WordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All Recipes
MEDIUM (5.4)
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2024-07-17T23:47:54.386Z
Updated: 2024-08-02T04:26:15.962Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39680 |
vulnerable | 2026-06-08 06:41:51.382702 |
WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save
MEDIUM (5.4)
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2024-07-17T23:47:52.745Z
Updated: 2024-08-02T04:26:16.019Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39679 |
vulnerable | 2026-06-08 06:41:51.381100 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39678 |
vulnerable | 2026-06-08 06:41:51.380642 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37308 |
vulnerable | 2026-06-08 06:39:47.108741 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2022-3900 |
vulnerable | 2026-06-08 05:48:22.573777 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-24233 |
vulnerable | 2026-06-08 05:30:04.027473 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.
Inspect record JSON
Open this panel to browse, search, copy or download the JSON record.