CVE-2026-104719

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator...

EUVD-2026-116760

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator...

CVE-2026-104719

The CookieYes WordPress plugin before version 3.5.8 is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The root cause is that the plugin fails to properly restrict write access to its cookie-category script fields and fails to sanitize or escape the input. This allows users with the Contr...