Improper neutralization of user input during web page generation in the Gora Tech Cooked WordPress plugin creates a stored cross‑site scripting flaw described by CWE‑79. The flaw allows an attacker to insert arbitrary JavaScript into content that is then rendered to and executed in the browsers of anyone who visits the affected page, leading to potential session hijacking, defacement, or execution of additional malicious payloads.

The vulnerability affects the Cooked plugin from Gora Tech, from an unspecified initial release through version 1.11.3 of the plugin. Any WordPress installation running Cooked 1.11.3 or earlier is potentially impacted until the patch is applied.

The CVSS score of 5.9 indicates moderate severity, and the EPSS score of less than 1% suggests a very low likelihood of exploitation at present. The vulnerability is not listed in CISA’s KEV catalog. Exploitation requires an attacker to supply malicious script in stored content, which can be delivered via the plugin’s content editor. Once injected, the script runs in the context of normal visitors, implying a high impact on confidentiality and integrity of data presented to users, while the scope is limited to the web front‑end rather than the server.