CVE-2024-37308

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. A patch is available at commit 8cf88f334ccbf11134080bbb655c66f1cfe77026 and will be part of version 1.8.0.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
XjSv	Cooked	< 1.8.0
boxystudio	cooked	<= 1.7.15.4

References

https://github.com/XjSv/Cooked/commit/8cf88f334ccbf11134080bbb655c66f1cfe77026Patch
https://github.com/XjSv/Cooked/security/advisories/GHSA-9vfv-c966-jwrvExploit, Vendor Advisory
https://github.com/XjSv/Cooked/commit/8cf88f334ccbf11134080bbb655c66f1cfe77026Patch
https://github.com/XjSv/Cooked/security/advisories/GHSA-9vfv-c966-jwrvExploit, Vendor Advisory

Timeline

Published: Jun 13, 2024
Last modified: Jun 17, 2026
NVD status: Analyzed

Related CVEs from 2024

CVE-2024-373095.3CrateDB is a distributed SQL database. A high-risk vulnerability has been identified in versions prior to 5.7.2 where the TLS endpoint (port CVE-2024-37316.1The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 's' parameter in all versi CVE-2024-373109.0EVerest is an EV charging software stack. An integer overflow in the "v2g_incoming_v2gtp" function in the v2g_server.cpp implementation can CVE-2024-373118.2Collabora Online is a collaborative online office suite based on LibreOffice. In affected versions of Collabora Online, https connections fr CVE-2024-373126.3user_oidc app is an OpenID Connect user backend for Nextcloud. Missing access control on the ID4me endpoint allows an attacker to register a CVE-2024-373137.5Nextcloud server is a self hosted personal cloud system. Under some circumstance it was possible to bypass the second factor of 2FA after su CVE-2024-373143.5Nextcloud Photos is a photo management app. Users can remove photos from the album of registered users. It is recommended that the Nextcloud CVE-2024-373154.3Nextcloud Server is a self hosted personal cloud system. An attacker with read-only access to a file is able to restore older versions of a CVE-2024-373164.6Nextcloud Calendar is a calendar app for Nextcloud. Authenticated users could create an event with manipulated attachment data leading to a CVE-2024-373174.6The Nextcloud Notes app is a distraction free notes taking app for Nextcloud. If an attacker managed to share a folder called `Notes/` with CVE-2024-373188.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability CVE-2024-373198.8SQL Server Native Client OLE DB Provider Remote Code Execution Vulnerability