Gora Tech Cooked vulnerabilities

• boxy studio cooked WordPress Cooked plugin <= 1.16.0 - Insecure Direct Object References (IDOR) vulnerability CVE-2026-73999 5.4 MediumSeptember 17, 2026
• boxy studio cooked WordPress Cooked plugin <= 1.11.3 - Cross Site Scripting (XSS) vulnerability CVE-2025-62989 5.9 MediumDecember 31, 2025
• boxy studio cooked WordPress Cooked plugin <= 1.11.3 - Broken Access Control vulnerability CVE-2025-68586 5.3 MediumDecember 24, 2025