CVE-2026-104719: CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts
The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CookieYesto a version that resolves this vulnerability.Fixed in 3.5.8
Event History
Frequently Asked Questions
Who can exploit this issue?
A user with the WordPress Contributor role or higher can exploit it by writing JavaScript into CookieYes cookie-category script fields. Exploitation also requires a victim, such as a site visitor or administrator reviewing the content, to load the stored script.
Are sites using the vulnerable plugin affected by default?
The available information does not establish whether the vulnerable cookie-category script fields are enabled or reachable in a default CookieYes configuration. Exposure depends on whether Contributor-level users can access and write to those fields.
What can be done if updating is not immediately possible?
Restrict or remove Contributor access for untrusted users, since that role can store the malicious JavaScript. Review the CookieYes cookie-category script fields for unauthorized or unexpected scripts and remove any suspicious entries.
How can an administrator check for compromise?
Inspect CookieYes cookie-category script fields for unexpected JavaScript or script references, especially entries created or changed by Contributor-level accounts. Review Contributor accounts and their recent activity for unauthorized changes to those fields.