PT-2024-29582

CVE-2024-41816

Published

2024-08-05

Updated

2024-08-06

Description by

CVSS 3.1

5.4

Medium

MetricsAV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cooked plugin for WordPress versions up to, and including, 1.8.0

Description The issue is related to Persistent Cross-Site Scripting (XSS) via the [cooked-timer] shortcode due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page.

Recommendations For Cooked plugin for WordPress versions up to, and including, 1.8.0, upgrade to release version 1.8.1 to address the issue.

Exploitability

Exploit

Fix

Impacts

Researchers

Iamr3N0

v3xx

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')