PT-2024-29582 · WordPress · Cooked

Iamr3N0 + 1 · Published 2024-08-05 · Updated 2024-08-06 · CVE-2024-41816

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Cooked plugin for WordPress versions up to, and including, 1.8.0

Description The issue is related to Persistent Cross-Site Scripting (XSS) via the [cooked-timer] shortcode due to insufficient input sanitization and output escaping. This allows authenticated attackers with subscriber-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page.

Recommendations For Cooked plugin for WordPress versions up to, and including, 1.8.0, upgrade to release version 1.8.1 to address the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-41816

GHSA-3GW3-2QJQ-XQJJ

Affected Products

Cooked

References · 6

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/41xxx/CVE-2024-41816.json · Exploit
• https://github.com/XjSv/Cooked/security/advisories/GHSA-3gw3-2qjq-xqjj · Vendor Advisory
• https://github.com/XjSv/Cooked/commit/ac7455bdccc99fb2f5b3c7611312947c1623c3ec · Patch
• https://osv.dev/vulnerability/CVE-2024-41816 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-41816 · Security Note
• https://t.me/cvedetector/2492 · Telegram Post