PT-2024-28622

CVE-2024-39682

Published

2024-07-17

Updated

2024-07-18

Description by

CVSS 3.1

6.4

Medium

MetricsAV:N/AC:L/PR:L/UI:N/S:C/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions Cooked plugin for WordPress versions up to, and including, 1.7.15.4

Description The Cooked plugin for WordPress is vulnerable to HTML Injection due to insufficient input sanitization and output escaping. This issue allows authenticated attackers with contributor-level access and above to inject arbitrary HTML in pages that will be shown whenever a user accesses a compromised page.

Recommendations For versions up to, and including, 1.7.15.4, upgrade to release version 1.8.0 to address the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Vendors

Affected products

Weakness enumeration

CWE-116: Improper Encoding or Escaping of Output

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers