Cooked vulnerabilities

3 known CVE vulnerabilities in Cooked, translated and rated.

CVE-2026-73999Medium
Insecure Direct Object References (IDOR) vulnerability in Cooked plugin up to version 1.16.0, affecting Contributor accounts. It allows unauthorized access to objects (e.g., posts, recipes), potentially exposing data.
CVE-2025-62989Medium
The Cooked plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization. This allows attackers to inject malicious scripts that execute when pages are viewed. Affects versions from n/a through 1.11.3.
CVE-2025-68586Medium
Missing Authorization vulnerability in Cooked (through version 1.11.3) allows exploiting incorrectly configured access control security levels.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS