CVE-2026-77829: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in goratech Cooked – Recipe Management

CVE-2026-77829 describes a stored Cross-Site Scripting vulnerability in the Cooked – Recipe Management plugin for WordPress. The flaw exists in all versions up to and including 1.16.1, where the [cooked-timer] shortcode content is not properly sanitized or escaped. This allows authenticated attackers with contributor-level privileges or higher to inject arbitrary JavaScript code into pages. When other users access these pages, the injected scripts execute, potentially leading to session hijacking or other client-side impacts. The CVSS 3.1 base score is 6.4, indicating a medium severity with network attack vector, low attack complexity, and no user interaction required.

An attacker with contributor-level access or higher can inject malicious scripts that execute in the browsers of users viewing the affected pages. This can lead to information disclosure or manipulation of client-side data. The vulnerability does not affect availability but impacts confidentiality and integrity. There are no known exploits in the wild at this time.

No official patch or fix is currently documented. Users should monitor the vendor's advisory for updates. Until a fix is available, restrict contributor-level access to trusted users and consider disabling or removing the Cooked – Recipe Management plugin if possible. Applying strict input validation and output escaping in custom code or using security plugins that filter XSS may reduce risk.