CVE-2025-62989
MediumCVSS 5.9Exploitation Probability (EPSS)
Low risk6th percentile - higher than 6% of all known CVEs
Summary
The Cooked plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization. This allows attackers to inject malicious scripts that execute when pages are viewed. Affects versions from n/a through 1.11.3.
Risk Assessment
Stored XSS can lead to session hijacking, page defacement, or theft of sensitive user data.
Recommendation
Update the plugin to a fixed version, properly sanitize inputs and outputs, and consider using a web application firewall.
Other vulnerabilities in Cooked
See all- CVE-2026-73999Medium
Insecure Direct Object References (IDOR) vulnerability in Cooked plugin up to version 1.16.0, affecting Contributor accounts. It allows unauthorized access to objects (e.g., posts, recipes), potentially exposing data.
- CVE-2025-68586Medium
Missing Authorization vulnerability in Cooked (through version 1.11.3) allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through <= 1.11.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS