CVE-2026-104719

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator...

EUVD-2026-116760

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator...

CVE-2026-104719

The CookieYes WordPress plugin (versions before 3.5.8 ) is vulnerable to a Stored Cross-Site Scripting (XSS) flaw. The plugin fails to correctly restrict write access to its cookie-category script fields and lacks proper sanitization or escaping of these inputs. This allows users with the Contrib...

CVE-2026-104719 CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator...