CVE-2026-104719
Received Received - Intake

CookieYes WordPress Plugin Authenticated Stored XSS via Cookie-Category Script

Publication date: 2026-11-04

Last updated on: 2026-11-04

Assigner: WPScan

Description
The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-04
Last Modified
2026-11-04
Generated
2026-11-04
AI Q&A
2026-11-04
EPSS Evaluated
N/A
NVD
CVE-2026-104719
EUVD
EUVD-2026-116760

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Unknown CookieYes 0

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-UNKNOWN

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

The CookieYes WordPress plugin before version 3.5.8 has a stored Cross-Site Scripting (XSS) vulnerability. Users with the Contributor role can inject malicious JavaScript into cookie-category script fields because the plugin does not restrict or sanitize these inputs. This JavaScript executes in the browsers of site visitors and administrators.

Detection Guidance

Check if the CookieYes WordPress plugin version is below 3.5.8. Inspect user roles with Contributor access for unauthorized script modifications in cookie-category fields. Review browser console logs for unexpected JavaScript execution on site pages.

Impact Analysis

This vulnerability allows attackers with Contributor access to inject malicious scripts. These scripts can steal cookies, session tokens, or sensitive data from visitors and administrators. It may also deface websites or redirect users to malicious sites.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection. Unauthorized script execution may expose personal or health data, resulting in legal penalties and loss of compliance certifications.

Mitigation Strategies

Update the CookieYes plugin to version 3.5.8 or later immediately. Remove or restrict Contributor role permissions to edit plugin-related fields. Audit existing scripts in cookie-category fields for malicious content and sanitize inputs.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104719. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...