CVE-2026-119178: Smart Cookie Kit <= 2.3.2 - Unauthenticated Stored Cross-Site Scripting via Comment Content via Bundled Simple HTML DOM Noise Restoration
The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is specifically crafted to survive wpkses on save by storing hostile characters inside allowed HTML elements, with the attribute-breaking double-quote smuggled inside a permitted <code> body and reconstructed into a <abbr title> attribute only at render time by the plugin's own output buffer; exploitation requires an administrator to approve the comment and subsequently view the affected public post.
Event History
Frequently Asked Questions
What conditions are required for successful exploitation?
An unauthenticated attacker must submit a crafted comment payload. An administrator must then approve that comment, and a user must subsequently view the affected public post for the stored script to execute.
Are sites exposed without attacker authentication?
Yes. The vulnerable comment parameter can be used by unauthenticated attackers, although exploitation depends on administrator approval of the malicious comment.
Which installations are affected?
All Smart Cookie Kit versions up to and including 2.3.2 are affected.
How does the malicious content bypass normal comment filtering?
The payload is crafted to survive wp_kses during saving by placing hostile characters inside permitted HTML elements. The plugin's output buffer reconstructs those characters into an abbr title attribute when rendering the page.