Approved changes feed: RSS · Atom
cpe:2.3:a:boxystudio:cooked:*:*:*:*:*:*:*:*
part: a version: * update: *
| Vendor | Boxystudio (e909dc9c-3e7f-559e-97e9-706bc0afb9fd) |
|---|---|
| Product | Cooked (289a879f-55c0-55bb-9cbd-768ddf05ed29) |
| Edition | * |
| Language | * |
| Software edition | * |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from gcve-enriched-dumps CVE data |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
| No PURL mappings for this CPE yet. | ||
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2024-39681 |
vulnerable | 2026-06-08 06:41:51.383079 |
WordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All Recipes
MEDIUM (5.4)
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2024-07-17T23:47:54.386Z
Updated: 2024-08-02T04:26:15.962Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-39680 |
vulnerable | 2026-06-08 06:41:51.382621 |
WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save
MEDIUM (5.4)
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing an action they didn't intend to perform under their current authentication. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.
Published: 2024-07-17T23:47:52.745Z
Updated: 2024-08-02T04:26:16.019Z |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2024-37308 |
vulnerable | 2026-06-08 06:39:47.099183 |
WordPress Cooked Plugin - Authenticated (Contributor+) Persistent Cross-Site Scripting Vulnerability
MEDIUM (5.4)
The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. A patch is available at commit 8cf88f334ccbf11134080bbb655c66f1cfe77026 and will be part of version 1.8.0.
Published: 2024-06-13T13:46:14.254Z
Updated: 2024-08-02T03:50:56.116Z |
Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.