Gora Tech vulnerabilities and threats

The Cooked – Recipe Management WordPress plugin is affected by a stored cross-site scripting (XSS) vulnerability in the [cooked-timer] shortcode content. This vulnerability exists in all versions up to and including 1.16.1 and allows authenticated users with contributor-level access or higher to inject malicious scripts that execute when other users view the affected pages.

Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through <= 1.11.3.

Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooked: from n/a through <= 1.11.3.