{"id":"CVE-2026-119178","kind":"vulnerability","aliases":["CVE-2026-119178"],"related":[],"title":"Smart Cookie Kit WordPress plugin: stored script injection via comment field","description":"The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is specifically crafted to survive wp_kses on save by storing hostile characters inside allowed HTML elements, with the attribute-breaking double-quote smuggled inside a permitted <code> body and reconstructed into a <abbr title> attribute only at render time by the plugin's own output buffer; exploitation requires an administrator to approve the comment and subsequently view the affected public post.","summary":"The Smart Cookie Kit WordPress plugin up to and including 2.3.2 fails to sanitize the 'comment' parameter, so attacker-supplied HTML survives saving and runs as script when a page is rendered. An attacker can run JavaScript in the browser of visitors to the affected public post, such as an administrator.","severity":"medium","cvss":5.4,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["other","smart-cookie-kit","wordpress"],"not_affected_if":["plugin-not-installed","plugin-updated"],"how_to_check":"- Check whether the Smart Cookie Kit plugin is installed and its version in the WordPress admin plugin list\n- Confirm whether the installed version is `2.3.2` or earlier\n- Review pending comments on public posts for markup that contains attribute-breaking quotes or script-like content","fix":"- Update the Smart Cookie Kit plugin to a version later than `2.3.2`; the fixed version is not stated in the sources","status":"open","published_at":"2026-11-06T12:17:19+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","triaged_at":"2026-11-06T12:42:52+00:00","updated_at":"2026-11-06T12:42:52+00:00","category":"other","confidence":0.8,"triage":{"at":"2026-11-06T12:42:52Z","model":"claude-haiku-5-5","output":{"fix":"- Update the Smart Cookie Kit plugin to a version later than `2.3.2`; the fixed version is not stated in the sources","reach":"internet","title":"Smart Cookie Kit WordPress plugin: stored script injection via comment field","impact":"medium","summary":"The Smart Cookie Kit WordPress plugin up to and including 2.3.2 fails to sanitize the 'comment' parameter, so attacker-supplied HTML survives saving and runs as script when a page is rendered. An attacker can run JavaScript in the browser of visitors to the affected public post, such as an administrator.","audience":"businesses","category":"other","nicknames":[],"who_cares":["wordpress","smart-cookie-kit"],"confidence":0.8,"fix_status":"unknown","needs_auth":"no","worst_case":"Script runs in visitors' browsers, including administrators, on the affected page","analyst_note":"","how_to_check":"- Check whether the Smart Cookie Kit plugin is installed and its version in the WordPress admin plugin list\n- Confirm whether the installed version is `2.3.2` or earlier\n- Review pending comments on public posts for markup that contains attribute-breaking quotes or script-like content","plain_action":"","needs_analyst":false,"not_affected_if":["plugin-not-installed","plugin-updated"],"who_is_affected":"Sites running the Smart Cookie Kit WordPress plugin version 2.3.2 or earlier are exposed. Exploitation requires an administrator to approve the malicious comment and then view the affected public post, so sites without this plugin can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000736,"input_tokens":4408,"output_tokens":591,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-119178':14A,17A '-2026':13A,16A '2.3.2':34B,102C 'abbr':172C 'access':131C 'administr':75B,189C 'affect':69B,198C 'allow':151C 'approv':191C 'arbitrari':120C 'attack':43B,58B,117C 'attacker-suppli':42B 'attribut':157C,174C 'attribute-break':156C 'bodi':167C 'break':158C 'browser':64B 'buffer':185C 'charact':149C 'code':166C 'comment':10A,39B,93C,193C 'cooki':2A,21B,26B,78C 'craft':139C 'cross':88C 'cross-sit':87C 'cve':12A,15A 'doubl':160C 'double-quot':159C 'due':103C 'element':153C 'escap':110C 'execut':127C 'exploit':186C 'fail':35B 'field':11A 'hostil':148C 'html':45B,152C 'includ':33B,101C 'inject':8A,119C,133C 'input':106C 'insid':150C,163C 'insuffici':105C 'javascript':61B 'kit':3A,22B,27B,79C 'kses':143C 'make':112C 'output':109C,184C 'page':54B,124C,134C 'paramet':40B,94C 'payload':136C 'permit':165C 'plugin':5A,29B,80C,181C 'possibl':114C 'post':71B,200C 'public':70B,199C 'quot':161C 'reconstruct':169C 'render':56B,177C 'requir':187C 'run':49B,60B 'sanit':37B,107C 'save':47B,145C 'script':7A,51B,90C,122C 'site':89C 'smart':1A,20B,25B,77C 'smart-cookie-kit':19B 'smuggl':162C 'specif':138C 'store':6A,86C,147C 'subsequ':195C 'suppli':44B 'surviv':46B,141C 'time':178C 'titl':173C 'unauthent':116C 'user':130C 'version':97C 'via':9A,91C 'view':196C 'visitor':66B 'vulner':84C 'web':121C 'whenev':128C 'wordpress':4A,23B,28B,82C 'wp':142C","nicknames":[],"mitigations":[],"who_affected":"Sites running the Smart Cookie Kit WordPress plugin version 2.3.2 or earlier are exposed. Exploitation requires an administrator to approve the malicious comment and then view the affected public post, so sites without this plugin can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"unknown","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["medium","other","smartcookiekit","wordpress"],"campaign_type":null,"search_a":"'-119178':14A,17A '-2026':13A,16A 'comment':10A 'cooki':2A 'cve':12A,15A 'field':11A 'inject':8A 'kit':3A 'plugin':5A 'script':7A 'smart':1A 'store':6A 'via':9A 'wordpress':4A","search_b":"'2.3.2':34B 'administr':75B 'affect':69B 'attack':43B,58B 'attacker-suppli':42B 'browser':64B 'comment':39B 'cooki':21B,26B 'fail':35B 'html':45B 'includ':33B 'javascript':61B 'kit':22B,27B 'page':54B 'paramet':40B 'plugin':29B 'post':71B 'public':70B 'render':56B 'run':49B,60B 'sanit':37B 'save':47B 'script':51B 'smart':20B,25B 'smart-cookie-kit':19B 'suppli':44B 'surviv':46B 'visitor':66B 'wordpress':23B,28B","search_c":"'2.3.2':102C 'abbr':172C 'access':131C 'administr':189C 'affect':198C 'allow':151C 'approv':191C 'arbitrari':120C 'attack':117C 'attribut':157C,174C 'attribute-break':156C 'bodi':167C 'break':158C 'buffer':185C 'charact':149C 'code':166C 'comment':93C,193C 'cooki':78C 'craft':139C 'cross':88C 'cross-sit':87C 'doubl':160C 'double-quot':159C 'due':103C 'element':153C 'escap':110C 'execut':127C 'exploit':186C 'hostil':148C 'html':152C 'includ':101C 'inject':119C,133C 'input':106C 'insid':150C,163C 'insuffici':105C 'kit':79C 'kses':143C 'make':112C 'output':109C,184C 'page':124C,134C 'paramet':94C 'payload':136C 'permit':165C 'plugin':80C,181C 'possibl':114C 'post':200C 'public':199C 'quot':161C 'reconstruct':169C 'render':177C 'requir':187C 'sanit':107C 'save':145C 'script':90C,122C 'site':89C 'smart':77C 'smuggl':162C 'specif':138C 'store':86C,147C 'subsequ':195C 'surviv':141C 'time':178C 'titl':173C 'unauthent':116C 'user':130C 'version':97C 'via':91C 'view':196C 'vulner':84C 'web':121C 'whenev':128C 'wordpress':82C 'wp':142C","first_public_at":"2026-11-06T12:17:19+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N","cvss_by":"security@wordfence.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-119178","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-119178","severity":null,"published_at":"2026-11-06T12:17:19+00:00","modified_at":"2026-11-06T12:17:19+00:00","first_seen_at":"2026-11-06T12:41:48+00:00","fetched_at":"2026-11-06T12:41:48+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}