This vulnerability (CVE-2024-49289) in Cooked Pro is a stored XSS issue caused by improper input sanitization during web page generation. Attackers can inject malicious scripts that persist and execute in the context of other users' browsers, potentially leading to information disclosure, session hijacking, or other impacts. The CVSS vector indicates network attack vector, low attack complexity, requiring privileges and user interaction, with impacts on confidentiality, integrity, and availability at a low level. No patch or official fix has been documented as of the publication date.

Successful exploitation could allow an attacker with some privileges and requiring user interaction to execute arbitrary scripts in the context of affected users. This can lead to limited confidentiality, integrity, and availability impacts such as theft of user data, session tokens, or manipulation of displayed content. However, the impact is rated medium severity and no active exploitation is known.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, users should apply best practices for input validation and output encoding where possible. Monitor vendor communications for updates. No vendor advisory or official patch is currently available.