{"id":"CVE-2026-104719","kind":"vulnerability","aliases":["CVE-2026-104719"],"related":[],"title":"CookieYes WordPress plugin: contributors can inject scripts that run for visitors","description":"The CookieYes  WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.","summary":"The CookieYes WordPress plugin before 3.5.8 lets users with the Contributor role store JavaScript in its cookie-category script fields. That script then runs in the browsers of site visitors and of an administrator who reviews the content.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["cookieyes","package","self-hosted","wordpress"],"not_affected_if":["no-contributor-accounts","plugin-3.5.8-or-later"],"how_to_check":"- Check the installed CookieYes plugin version in the WordPress admin under Plugins; compare it with `3.5.8`.\n- Review which accounts hold the Contributor role on the site.","fix":"- CookieYes WordPress plugin: move to `3.5.8` or later.","status":"open","published_at":"2026-11-04T06:16:57+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","triaged_at":"2026-11-04T06:26:36+00:00","updated_at":"2026-11-04T06:26:36+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-04T06:26:36Z","model":"claude-haiku-5-5","output":{"fix":"- CookieYes WordPress plugin: move to `3.5.8` or later.","reach":"network","title":"CookieYes WordPress plugin: contributors can inject scripts that run for visitors","impact":"medium","summary":"The CookieYes WordPress plugin before 3.5.8 lets users with the Contributor role store JavaScript in its cookie-category script fields. That script then runs in the browsers of site visitors and of an administrator who reviews the content.","audience":"businesses","category":"package","nicknames":[],"who_cares":["wordpress","cookieyes","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker script runs in visitors' and administrators' browsers on the site.","analyst_note":"","how_to_check":"- Check the installed CookieYes plugin version in the WordPress admin under Plugins; compare it with `3.5.8`.\n- Review which accounts hold the Contributor role on the site.\n- unknown for any other check, as the sources do not say.","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-3.5.8-or-later","no-contributor-accounts"],"who_is_affected":"Sites running the CookieYes WordPress plugin before 3.5.8 that have users with the Contributor role. Sites without the plugin, or running 3.5.8 or later, are not affected by this description.","user_interaction":"yes","needs_special_setup":"no","severity_if_unknown":"medium"},"cost_usd":0.000672,"input_tokens":4119,"output_tokens":521,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-104719':14A,17A '-2026':13A,16A '3.5.8':29B,68C 'administr':58B,109C 'allow':89C 'browser':51B,102C 'categori':42B,79C 'content':62B,112C 'contributor':4A,34B,93C 'cooki':41B,78C 'cookie-categori':40B,77C 'cookiey':1A,18B,25B,64C 'correct':71C 'cve':12A,15A 'escap':87C 'execut':99C 'field':44B,81C 'host':22B 'inject':6A 'javascript':37B,97C 'let':30B 'packag':19B 'plugin':3A,27B,66C 'restrict':72C 'review':60B,110C 'role':35B,94C 'run':9A,48B 'sanit':85C 'script':7A,43B,46B,80C 'self':21B 'self-host':20B 'site':53B,104C 'store':36B,96C 'user':31B,90C 'visitor':11A,54B,105C 'wordpress':2A,23B,26B,65C 'write':75C","nicknames":[],"mitigations":[],"who_affected":"Sites running the CookieYes WordPress plugin before 3.5.8 that have users with the Contributor role. Sites without the plugin, or running 3.5.8 or later, are not affected by this description.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["cookieyes","medium","package","selfhosted","wordpress"],"campaign_type":null,"first_public_at":"2026-11-04T06:16:57+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-104719","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-104719","severity":null,"published_at":"2026-11-04T06:16:57+00:00","modified_at":"2026-11-04T06:16:57+00:00","first_seen_at":"2026-11-04T06:25:17+00:00","fetched_at":"2026-11-04T06:25:17+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}