CVE-2024-37308
CVSS V2 None
CVSS V3 None
Description
The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary web scripts in pages that will execute whenever a user accesses a compromised page. A patch is available at commit 8cf88f334ccbf11134080bbb655c66f1cfe77026 and will be part of version 1.8.0.
Overview
- CVE ID
- CVE-2024-37308
- Assigner
- GitHub_M
- Vulnerability Status
- PUBLISHED
- Published Version
- 2024-06-13T13:46:14.254Z
- Last Modified Date
- 2024-06-13T15:43:28.264Z
Weakness Enumerations
References
| Reference URL | Reference Tags |
|---|---|
| https://github.com/XjSv/Cooked/security/advisories/GHSA-9vfv-c966-jwrv | x_refsource_CONFIRM |
| https://github.com/XjSv/Cooked/commit/8cf88f334ccbf11134080bbb655c66f1cfe77026 | x_refsource_MISC |
Sources
| Source Name | Source URL |
|---|---|
| NIST | https://nvd.nist.gov/vuln/detail/CVE-2024-37308 |
| MITRE | https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-37308 |
History
| Created | Old Value | New Value | Data Type | Notes |
|---|---|---|---|---|
| 2024-06-26 01:18:04 | Added to TrackCVE |