CVE-2026-77829

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-77829

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in all versions up to and including 1.16.1 . The root cause is insufficient input sanitization and output escaping within the [cooked-timer] shortcode content . This allows authenticated attacke...

CVE-2026-77829 Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-77829 Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

EUVD-2026-102610

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

PT-2026-115415

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2026-77829: Improper Neutralization of Input During Web Page Generation

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via cooked-timer Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Cooked Cross-Site Scripting Vulnerability

WordPress Cooked 1.16.1 and earlier versions have a cross-site scripting vulnerability. This vulnerability stems from insufficient input cleaning and output escaping for the cooked-timer short-code content. It may allow authenticated attackers with privileges of contributor or higher to inject...

WordPress Cooked – Recipe Management plugin <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Wordfence PRISM in WordPress Plugin Cooked versions = 1.16.1...

CVE-2026-73999

Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...

CVE-2026-73999 WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...

CVE-2026-73999 WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability

Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...

EUVD-2026-81513

Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...

CVE-2026-73999

The Cooked WordPress plugin (versions

CVE-2026-73999: Authorization Bypass Through User-Controlled Key

Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...

PT-2026-94280

Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...

WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability

Insecure Direct Object References IDOR vulnerability discovered by Nixxies in WordPress Plugin Cooked versions = 1.16.0...

BIT-DISCOURSE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag...

CVE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...

CVE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing

Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...