CVE-2024-41816 WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode

🗓️ 05 Aug 2024 20:12:41Reported by GoogleType

osv🔗 osv.dev👁 9 Views

The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. Authenticated attackers with subscriber-level access and above can inject arbitrary web scripts in pages, addressed in release 1.8.1

Reporter	Title	Published	Views	Family All 12
Circl	CVE-2024-41816	5 Aug 202423:06	–	circl
CNNVD	WordPress plugin Cooked 安全漏洞	5 Aug 202400:00	–	cnnvd
CVE	CVE-2024-41816	5 Aug 202420:12	–	cve
Cvelist	CVE-2024-41816 WordPress Cooked Plugin Persistent Cross-Site Scripting via Shortcode	5 Aug 202420:12	–	cvelist
EUVD	EUVD-2024-39201	3 Oct 202520:07	–	euvd
NVD	CVE-2024-41816	5 Aug 202420:15	–	nvd
Patchstack	WordPress Cooked Plugin <= 1.8.0 is vulnerable to Cross Site Scripting (XSS)	6 Aug 202400:00	–	patchstack
Patchstack	WordPress Cooked Plugin <= 1.8.0 - Authenticated (Subscriber+) Persistent Cross-Site Scripting via Shortcode vulnerability	6 Aug 202403:06	–	patchstack
Positive Technologies	PT-2024-29582 · WordPress · Cooked	5 Aug 202400:00	–	ptsecurity
RedhatCVE	CVE-2024-41816	9 Jan 202609:04	–	redhatcve

Source	Link
github	www.github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41816.json
github	www.github.com/XjSv/Cooked/security/advisories/GHSA-3gw3-2qjq-xqjj
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-41816
github	www.github.com/XjSv/Cooked/commit/ac7455bdccc99fb2f5b3c7611312947c1623c3ec

02 Apr 2026 12:17Current

5.4Medium risk

Vulners AI Score5.4

CVSS 3.15.4

EPSS0.0193