158 matches found
CVE-2026-73999
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
CVE-2026-73999 WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
EUVD-2026-81513
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
CVE-2026-73999 WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
CVE-2026-73999
The Cooked WordPress plugin (versions
CVE-2026-73999: Authorization Bypass Through User-Controlled Key
Contributor Insecure Direct Object References IDOR in Cooked = 1.16.0 versions...
WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability
Insecure Direct Object References IDOR vulnerability discovered by Nixxies in WordPress Plugin Cooked versions = 1.16.0...
BIT-DISCOURSE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and hashtag...
CVE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...
CVE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...
CVE-2026-72720 Discourse: HTML injection in PrettyText.format_for_email from cooked-attribute reparsing
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...
CVE-2026-72720: Improper Neutralization of Input During Web Page Generation
Discourse is an open-source discussion platform. Prior to 2026.1.7, 2026.6.2, 2026.7.1, and 2026.8.0-latest.1, Discourse has HTML injection in PrettyText.formatforemail because cooked attribute values are reparsed as markup. Crafted Vimeo iframe sources, secure-upload URLs or dimensions, and...
CVE-2024-41816
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting XSS via the ‘cooked-timer’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticate...
CVE-2024-39681
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery CSRF in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users...
CVE-2024-39678
Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery CSRF in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing...
CVE-2024-39679
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery CSRF in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users...
CVE-2024-39680
Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery CSRF in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users...
CVE-2025-62989
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through = 1.11.3...