CVE-2022-23072 Recipes - Stored XSS in Add to Cart
A low-privileged attacker can inject malicious scripts via the food name field, leading to victim session hijacking and potential admin account takeover.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2022-23072?
CVE-2022-23072 is a low-severity cross-site scripting vulnerability in recipes, published on 21 Jun 2022. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
In Recipes, versions 1.0.5 through 1.2.5 are vulnerable to Stored Cross-Site Scripting (XSS), in “Add to Cart” functionality. When a victim accesses the food list page, then adds a new Food with a malicious javascript payload in the ‘Name’ parameter and clicks on the Add to Shopping Cart icon, an XSS payload will trigger. A low privileged attacker will have the victim's API key and can lead to admin's account takeover.
Weakness: CWE-79
Which versions are affected by CVE-2022-23072?
It affects 1 product.
Products include Tandoor Recipes.
How do I fix CVE-2022-23072?
No fix has been published for CVE-2022-23072 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2022-23072 being exploited?
There is no known exploitation of CVE-2022-23072 in the wild and no public exploit code.
Other vulnerabilities in recipes
- CVE-2025-23211 Tandoor Recipes - SSTI - Remote Code Execution
- CVE-2026-33152 Tandoor Recipes Vulnerable to Unrestricted Brute-Force via BasicAuthentication
- CVE-2025-23213 Tandoor Recipes - Stored XSS through Unrestricted File Upload
- CVE-2026-35488 Tandoor Recipes — CustomIsShared permits DELETE/PUT on RecipeBook by shared (read-only) users
- CVE-2026-35045 Tandoor Recipes Affected by Private Recipe Exposure and Unauthorized Modification
Sources
Also known as GHSA-jwqf-wr86-3pxv.