Iamr3N0

The issue is related to Persistent Cross-Site Scripting (XSS) via the `[cooked-timer]` shortcode due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page.

The Cooked plugin for WordPress is affected by a Cross-Site Request Forgery (CSRF) issue due to missing or incorrect nonce validation on the AJAX action handler. This could allow an attacker to trick users into performing unintended actions under their current authentication.

The issue is related to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the AJAX action handler. This could allow an attacker to trick users into performing unintended actions under their current authentication. The problem has been addressed in release version 1.8.0.

The issue is related to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the AJAX action handler. This could allow an attacker to trick users into performing unintended actions under their current authentication.

The Cooked plugin for WordPress is vulnerable to HTML Injection due to insufficient input sanitization and output escaping. This issue allows authenticated attackers with contributor-level access and above to inject arbitrary HTML in pages that will be shown whenever a user accesses a compromised page.

The issue is related to Cross-Site Request Forgery (CSRF) due to missing or incorrect nonce validation on the AJAX action handler. This could allow an attacker to trick users into performing unintended actions under their current authentication. The problem has been addressed in release version 1.8.0.

The issue is related to Persistent Cross-Site Scripting (XSS) via the ` recipe settings[post title]` parameter due to insufficient input sanitization and output escaping. This allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page.