CVE-2026-104719: medium-severity vulnerability in CookieYes
CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts
Published
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
33Vexday Risk Score
No sign of exploitation. It has a public proof of concept.
ssvc Attendcvss 6.4epss 0.3%
The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.
CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
Affected products
Unknown · CookieYespublic PoCs found — 1
cve_referencewpscan.com/vulnerability/fd1e087e-99b2-4942-82ee-44160ad77151/unverified⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.