CVE-2026-77829
MediumCVSS 6.4Summary
The Cooked – Recipe Management plugin for WordPress (versions up to and including 1.16.1) is vulnerable to Stored Cross-Site Scripting via [cooked-timer] shortcode content due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.
Risk Assessment
An attacker can execute arbitrary JavaScript in a visitor's browser, potentially leading to session theft or other actions in the user's context.
Recommendation
Update the Cooked plugin to a version later than 1.16.1, and until then restrict Contributor-level and higher access to trusted users.
Other vulnerabilities in Cooked
See all- CVE-2026-73999Medium
Insecure Direct Object References (IDOR) vulnerability in Cooked plugin up to version 1.16.0, affecting Contributor accounts. It allows unauthorized access to objects (e.g., posts, recipes), potentially exposing data.
- CVE-2025-62989Medium
The Cooked plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization. This allows attackers to inject malicious scripts that execute when pages are viewed. Affects versions from n/a through 1.11.3.
- CVE-2025-68586Medium
Missing Authorization vulnerability in Cooked (through version 1.11.3) allows exploiting incorrectly configured access control security levels.
Original NVD description (English source)
The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS