CVE-2024-39682 WordPress Cooked Plugin - Authenticated (Contributor+) HTML Injection via Recipe Excerpt

Medium 6.4 Published 17 Jul 2024 Updated 2 Aug 2024

Authenticated contributors can inject arbitrary HTML into recipe excerpts, potentially leading to script execution or session hijacking for site visitors.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2024-39682?

CVE-2024-39682 is a medium-severity cross-site scripting vulnerability in XjSv Cooked, published on 17 Jul 2024. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above to inject arbitrary HTML in pages that will be shown whenever a user accesses a compromised page. This issue has been addressed in release version 1.8.0. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Weakness: CWE-79, CWE-116

Which versions are affected by CVE-2024-39682?

It affects 1 product.

Products include Boxystudio Cooked.

How do I fix CVE-2024-39682?

No fix has been published for CVE-2024-39682 yet. Limit exposure of the affected software until one is available.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2024-39682 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2024-39682 exists.

Sources

Also known as GHSA-fx69-f77x-84gr.