CVE-2024-41816
- Source
- https://cve.org/CVERecord?id=CVE-2024-41816
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-41816.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2024-41816
- Aliases
-
- GHSA-3gw3-2qjq-xqjj
- Published
- 2024-08-05T20:12:41.428Z
- Modified
- 2026-02-17T23:37:12.210916Z
- Severity
-
- 5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode
- Details
-
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.1. All users are advised to upgrade. There are no known workarounds for this vulnerability.
- Database specific
{ "cna_assigner": "GitHub_M", "cwe_ids": [ "CWE-79" ], "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41816.json" }- References