CVE-2025-68586
MediumCVSS 5.3Exploitation Probability (EPSS)
Low risk16th percentile - higher than 16% of all known CVEs
Summary
Missing Authorization vulnerability in Cooked (through version 1.11.3) allows exploiting incorrectly configured access control security levels.
Risk Assessment
Unauthorized users may modify recipes or settings, affecting content integrity.
Recommendation
Update the Cooked plugin to the latest version that includes the security fix.
Other vulnerabilities in Cooked
See all- CVE-2026-77829Medium
The Cooked – Recipe Management plugin for WordPress (versions up to and including 1.16.1) is vulnerable to Stored Cross-Site Scripting via [cooked-timer] shortcode content due to insufficient input sanitization and output escaping. An authenticated attacker with Contributor-level access or above can inject arbitrary web scripts that execute when a user visits the injected page.
- CVE-2026-73999Medium
Insecure Direct Object References (IDOR) vulnerability in Cooked plugin up to version 1.16.0, affecting Contributor accounts. It allows unauthorized access to objects (e.g., posts, recipes), potentially exposing data.
- CVE-2025-62989Medium
The Cooked plugin for WordPress has a stored Cross-Site Scripting (XSS) vulnerability due to improper input neutralization. This allows attackers to inject malicious scripts that execute when pages are viewed. Affects versions from n/a through 1.11.3.
Original NVD description (English source)
Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooked: from n/a through <= 1.11.3.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS