UNKNOWN NVD

CVE-2026-104719

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them,

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.

References

https://wpscan.com/vulnerability/fd1e087e-99b2-4942-82ee-44160ad77151/

Published: 2026-11-04 · Source: NVD · Feed updated: 2026-11-04

This unknown severity vulnerability was published on 2026-11-04 via NVD.

vulnfeed aggregates 18348 vulnerabilities from NVD, CISA KEV, Ubuntu, Debian, Red Hat, Kubernetes, Exploit-DB, OSS-Security, GitHub and OpenStack — updated every 4 hours.