---
id: "CVE-2026-104719"
kind: "vulnerability"
aliases: ["CVE-2026-104719"]
title: "CookieYes WordPress plugin: contributors can inject scripts that run for visitors"
severity: "medium"
cvss: null
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["cookieyes", "package", "self-hosted", "wordpress"]
not_affected_if: ["no-contributor-accounts", "plugin-3.5.8-or-later"]
published_at: "2026-11-04T06:16:57+00:00"
first_seen_at: "2026-11-04T06:25:17+00:00"
updated_at: "2026-11-04T06:26:36+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-104719", "first_seen_at": "2026-11-04T06:25:17+00:00"}]
---

# CookieYes WordPress plugin: contributors can inject scripts that run for visitors

The CookieYes WordPress plugin before 3.5.8 lets users with the Contributor role store JavaScript in its cookie-category script fields. That script then runs in the browsers of site visitors and of an administrator who reviews the content.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed CookieYes plugin version in the WordPress admin under Plugins; compare it with `3.5.8`.
- Review which accounts hold the Contributor role on the site.

## Fix

- CookieYes WordPress plugin: move to `3.5.8` or later.

## Timeline

- 2026-11-04T06:25:17+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-104719

## From the sources

The CookieYes  WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_