Gora Tech vulnerabilities

Products

• Cooked 3
• Cooked Pro 3

Latest Gora Tech CVEs

Newest publication first

1. CVE-2026-73999 WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability

   Published 2026-09-17

   Medium·CVSS 5.4 EPSS 0.29%

   Contributor Insecure Direct Object References (IDOR) in Cooked <= 1.16.0 versions.

2. CVE-2025-62989 WordPress Cooked plugin <= 1.11.3 - Cross Site Scripting (XSS) vulnerability

   Published 2025-12-31

   Medium·CVSS 5.9 EPSS 0.17%

   Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gora Tech Cooked cooked allows Stored XSS.This issue affects Cooked: from n/a through <= 1.11.3.

3. CVE-2025-68586 WordPress Cooked plugin <= 1.11.3 - Broken Access Control vulnerability

   Published 2025-12-24

   Medium·CVSS 5.3 EPSS 0.25%

   Missing Authorization vulnerability in Gora Tech Cooked cooked allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Cooked: from n/a through <= 1.11.3.

4. CVE-2024-49290 WordPress Cooked Pro plugin < 1.8.0 - Cross Site Request Forgery (CSRF) vulnerability

   Published 2024-10-20

   High·CVSS 8.8 EPSS 0.22%

   Cross-Site Request Forgery (CSRF) vulnerability in Gora Tech LLC Cooked Pro allows Cross Site Request Forgery.This issue affects Cooked Pro: from n/a before 1.8.0.

5. CVE-2024-49289 WordPress Cooked Pro plugin < 1.8.0 - Cross Site Scripting (XSS) vulnerability

   Published 2024-10-17

   Medium·CVSS 6.5 EPSS 0.26%

   Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Gora Tech LLC Cooked Pro allows Stored XSS.This issue affects Cooked Pro: from n/a before 1.8.0.

6. CVE-2024-49291 WordPress Cooked Pro plugin < 1.8.0 - Unauthenticated Arbitrary File Upload vulnerability

   Published 2024-10-17

   Critical·CVSS 10.0 EPSS 0.51%

   Unrestricted Upload of File with Dangerous Type vulnerability in Gora Tech LLC Cooked Pro.This issue affects Cooked Pro: from n/a before 1.8.0.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.