CVE-2024-39682 - CVE House
Back to Database
Status published Medium CVE-2024-39682

WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt

Vulnerability Description

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary HTML in pages that will be shown whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-39682

Credits & Attribution

No credits recorded in the NVD database.

References

More from XjSv

View All →
CVE-2024-41816
WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode
Medium 5.4
CVE-2024-39681
WordPress Cooked Plugin - Cross-Site Request Forgery to Apply Template to All Recipes
Medium 5.4
CVE-2024-39680
WordPress Cooked Plugin - Cross-Site Request Forgery to Default Recipe Template Save
Medium 5.4
CVE-2024-39679
WordPress Cooked Plugin - Cross-Site Request Forgery to Recipe Template Reset
Medium 4.3
CVE-2024-39678
WordPress Cooked Plugin - Cross-Site Request Forgery to Get Recipe IDs
Medium 4.3

Affected Vendor

Affected Software

Cooked
Vulnerable Versions:
< 1.8.0

Timeline

Official Publish: July 17th, 2024
Last Modified: August 2nd, 2024
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Weaknesses (CWE)

CWE-116

MITRE ATT&CK TTPs

T1189 Drive-by Compromise
Initial Access
T1190 Exploit Public-Facing Application
Initial Access
T1059 Command and Scripting Interpreter
Execution
T1565.002 Stored Data Manipulation
Impact