The Cooked – Recipe Management plugin allows authenticated users with contributor or higher privileges to embed the [cooked‑timer] shortcode in content. The plugin fails to sanitize or escape the shortcode parameters, which lets an attacker inject arbitrary JavaScript that is stored in the database. When any user views a page containing the malicious shortcode, the injected script runs in that user’s browser, leading to session hijacking, phishing, or the execution of further malicious actions.

WordPress installations running Cooked – Recipe Management plugin version 1.16.1 or earlier are affected. This includes every site that has the plugin installed and the shortcodes used in posts, pages, or custom content types.

The vulnerability has a CVSS score of 6.4, indicating moderate severity. The EPSS score is 0.00243, reflecting a very low probability of exploitation. It is not listed in KEV, which suggests that it has not yet been widely abused. Because the attacker only needs contributor or higher level access, an internal user or a compromised contributor could exploit it, making the risk relatively high in environments with many contributors.