CVE-2026-77829: Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

Q: Which users could exploit this issue?

An attacker must be authenticated to the WordPress site and have at least Contributor-level access. No user interaction by the attacker is required after they can submit the malicious shortcode content.

Q: Where does the injected script execute?

The script is stored in page content through the [cooked-timer] shortcode and executes when another user accesses the affected page. The impact can therefore extend to users who view pages created or modified by a lower-privileged contributor.

Q: How can I identify potentially affected content?

Check sites running Cooked – Recipe Management version 1.16.1 or earlier and review page content containing the [cooked-timer] shortcode, particularly content submitted by Contributor-level or other non-administrative accounts.

Published Oct 16, 2026

Updated

The Cooked – Recipe Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via [cooked-timer] Shortcode Content in all versions up to, and including, 1.16.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page.

Affected Software

1 affected component

Fatcat Apps Cooked – Recipe Management<=1.16.1

Event History

Oct 16, 2026

CVE Published

via MITRE·03:38 AM

Data Sourced

via MITRE·03:38 AM

DescriptionSeverityWeakness

Frequently Asked Questions

Which users could exploit this issue?

An attacker must be authenticated to the WordPress site and have at least Contributor-level access. No user interaction by the attacker is required after they can submit the malicious shortcode content.

Where does the injected script execute?

The script is stored in page content through the [cooked-timer] shortcode and executes when another user accesses the affected page. The impact can therefore extend to users who view pages created or modified by a lower-privileged contributor.

How can I identify potentially affected content?

Check sites running Cooked – Recipe Management version 1.16.1 or earlier and review page content containing the [cooked-timer] shortcode, particularly content submitted by Contributor-level or other non-administrative accounts.

CVE-2026-77829: Cooked <= 1.16.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via [cooked-timer] Shortcode Content

Affected Software

Event History

Frequently Asked Questions

Which users could exploit this issue?

Where does the injected script execute?

How can I identify potentially affected content?

Company

Resources

Contact

Frequently Asked Questions

Which users could exploit this issue?

Where does the injected script execute?

How can I identify potentially affected content?