https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2024-49290.htmlhttps://patchthecve.com/cve/CVE-2024-49290.htmlWed, 17 Jun 2026 07:59:39 +0000MEDIUM 4.3: Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1.8.0.https://patchthecve.com/cve/CVE-2024-41816.htmlhttps://patchthecve.com/cve/CVE-2024-41816.htmlWed, 17 Jun 2026 07:48:17 +0000MEDIUM 5.4: Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the ‘[cooked-timer]’ shortcode in versions up to, and including, 1.8.0 due to insufficient input sanitization and output escaping. This vulnerability allows authenticathttps://patchthecve.com/cve/CVE-2024-39682.htmlhttps://patchthecve.com/cve/CVE-2024-39682.htmlWed, 17 Jun 2026 07:42:27 +0000MEDIUM 6.4: Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to HTML Injection in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers with contributor-level access and above tohttps://patchthecve.com/cve/CVE-2024-39681.htmlhttps://patchthecve.com/cve/CVE-2024-39681.htmlWed, 17 Jun 2026 07:42:27 +0000MEDIUM 5.4: Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users inhttps://patchthecve.com/cve/CVE-2024-39680.htmlhttps://patchthecve.com/cve/CVE-2024-39680.htmlWed, 17 Jun 2026 07:42:27 +0000MEDIUM 5.4: Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users inhttps://patchthecve.com/cve/CVE-2024-39679.htmlhttps://patchthecve.com/cve/CVE-2024-39679.htmlWed, 17 Jun 2026 07:42:26 +0000MEDIUM 4.3: Cooked is a recipe plugin for WordPress. The Cooked plugin for WordPress is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users inhttps://patchthecve.com/cve/CVE-2024-39678.htmlhttps://patchthecve.com/cve/CVE-2024-39678.htmlWed, 17 Jun 2026 07:42:26 +0000MEDIUM 4.3: Cooked is a recipe plugin for WordPress. The Cooked plugin is vulnerable to Cross-Site Request Forgery (CSRF) in versions up to, and including, 1.7.15.4 due to missing or incorrect nonce validation on the AJAX action handler. This vulnerability could allow an attacker to trick users into performing https://patchthecve.com/cve/CVE-2024-37308.htmlhttps://patchthecve.com/cve/CVE-2024-37308.htmlWed, 17 Jun 2026 07:38:06 +0000MEDIUM 5.4: The Cooked Pro recipe plugin for WordPress is vulnerable to Persistent Cross-Site Scripting (XSS) via the `_recipe_settings[post_title]` parameter in versions up to, and including, 1.7.15.4 due to insufficient input sanitization and output escaping. This vulnerability allows authenticated attackers https://patchthecve.com/cve/CVE-2022-36399.htmlhttps://patchthecve.com/cve/CVE-2022-36399.htmlWed, 17 Jun 2026 04:53:23 +0000MEDIUM 5.3: Exposure of Sensitive Information to an Unauthorized Actor vulnerability in BoxyStudio Booked - Appointment Booking for WordPress | Calendars.This issue affects Booked - Appointment Booking for WordPress | Calendars: from n/a before 2.4.4.https://patchthecve.com/cve/CVE-2023-44477.htmlhttps://patchthecve.com/cve/CVE-2023-44477.htmlWed, 17 Jun 2026 06:27:43 +0000MEDIUM 6.5: Auth. (contributor+) Stored Cross-Site Scripting (XSS) vulnerability in Boxy Studio Cooked plugin <= 1.7.13 versions.