CVE-2024-41816

MediumCVSS 5.4/10Last modified Jun 17, 2026

Description

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.

Metrics

CVSS 3.1 5.4/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Aug 5, 2024
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2024

CVE-2024-418177.8ImageMagick is a free and open-source software suite, used for editing and manipulating digital images. The `AppImage` version `ImageMagick`CVE-2024-418187.5fast-xml-parser is an open source, pure javascript xml parser. a ReDOS exists on currency.js. This vulnerability is fixed in 4.4.1.CVE-2024-418195.4Note Mark is a web-based Markdown notes app. A stored cross-site scripting (XSS) vulnerability in Note Mark allows attackers to execute arbiCVE-2024-41824.3Mattermost versions 9.6.0, 9.5.x before 9.5.3, 9.4.x before 9.4.5, and 8.1.x before 8.1.12 fail to handle JSON parsing errors in custom statCVE-2024-418206.0Kubean is a cluster lifecycle management toolchain based on kubespray and other cluster LCM engine. The ClusterRole has `*` verbs of `*` resCVE-2024-418246.5In JetBrains TeamCity before 2024.07 parameters of the "password" type could leak into the build log in some specific casesCVE-2024-418255.4In JetBrains TeamCity before 2024.07 stored XSS was possible on the Code Inspection tabCVE-2024-418264.8In JetBrains TeamCity before 2024.07 stored XSS was possible on Show Connection pageCVE-2024-418279.8In JetBrains TeamCity before 2024.07 access tokens could continue working after deletion or expirationCVE-2024-418286.5In JetBrains TeamCity before 2024.07 comparison of authorization tokens took non-constant timeCVE-2024-418297.5In JetBrains TeamCity before 2024.07 an OAuth code for JetBrains Space could be stolen via Space Application connectionCVE-2024-41836.5Mattermost versions 8.1.x before 8.1.12, 9.6.x before 9.6.1, 9.5.x before 9.5.3, 9.4.x before 9.4.5 fail to limit the number of active sessi