CVE-2026-77829 in Cooked Plugin
Summary
by MITRE • 10/16/2026
The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/16/2026
The Cooked – Recipe Management plugin for WordPress contains a critical security flaw identified as Stored Cross-Site Scripting within the cooked-timer shortcode content across all versions up to 1.16.1. This vulnerability stems from insufficient input sanitization and output escaping mechanisms, which fail to properly validate or encode user-supplied data before it is processed by the application. The technical nature of this flaw allows malicious actors to inject arbitrary web scripts into pages managed by the plugin. When a page containing these injected scripts is accessed by any user, the browser executes the code in the context of the site, leading to potential compromise of sensitive information or unauthorized actions performed on behalf of the victim.
The operational impact of this vulnerability is significant due to its stored nature and the relatively low privilege level required for exploitation. Attackers with contributor-level access and above can exploit this flaw without needing administrative privileges, which broadens the attack surface considerably within a WordPress environment where multiple users often have varying levels of content creation rights. Once an attacker successfully injects malicious scripts through the shortcode, these payloads persist in the database and are served to every visitor who views the affected page. This persistence distinguishes stored XSS from reflected variants, as it does not require tricking a user into clicking a specially crafted link; instead, mere access to the compromised content triggers execution.
From an industry standards perspective, this vulnerability aligns with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific vector involves insufficient sanitization and escaping, highlighting a failure in implementing secure coding practices for dynamic web content generation. Furthermore, the exploitation technique maps to MITRE ATT&CK techniques related to Client-Side Injection, specifically T1059 which covers Command and Scripting Interpreter execution via browser-based scripts. This categorization underscores the potential for attackers to leverage this flaw not just for defacement or cookie theft but potentially for more sophisticated attacks such as session hijacking or credential harvesting if combined with other social engineering tactics.
Mitigation strategies should focus on immediate remediation through software updates and enhanced security configurations. The primary recommendation is to upgrade the Cooked plugin to a version later than 1.16.1, where developers have presumably addressed these sanitization and escaping deficiencies. In cases where updating is not immediately feasible, administrators can implement temporary workarounds such as restricting contributor-level access or higher privileges only to trusted individuals who require content management capabilities. Additionally, deploying Web Application Firewalls with rulesets designed to detect and block XSS payloads in POST requests may provide an additional layer of defense by intercepting malicious inputs before they are stored in the database. Regular security audits and code reviews focusing on input validation and output encoding practices are essential for preventing similar vulnerabilities in future development cycles.