---
id: "CVE-2026-119178"
page: "https://infrastack.ai/live/CVE-2026-119178"
kind: "vulnerability"
aliases: ["CVE-2026-119178"]
title: "Smart Cookie Kit WordPress plugin: stored script injection via comment field"
severity: "medium"
cvss: 5.4
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["other", "smart-cookie-kit", "wordpress"]
not_affected_if: ["plugin-not-installed", "plugin-updated"]
published_at: "2026-11-06T12:17:19+00:00"
first_seen_at: "2026-11-06T12:41:48+00:00"
updated_at: "2026-11-06T12:42:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-119178", "first_seen_at": "2026-11-06T12:41:48+00:00"}]
exploit_sources: []
---

# Smart Cookie Kit WordPress plugin: stored script injection via comment field

Link for people: https://infrastack.ai/live/CVE-2026-119178 (this .md is for agents)

The Smart Cookie Kit WordPress plugin up to and including 2.3.2 fails to sanitize the 'comment' parameter, so attacker-supplied HTML survives saving and runs as script when a page is rendered. An attacker can run JavaScript in the browser of visitors to the affected public post, such as an administrator.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check whether the Smart Cookie Kit plugin is installed and its version in the WordPress admin plugin list
- Confirm whether the installed version is `2.3.2` or earlier
- Review pending comments on public posts for markup that contains attribute-breaking quotes or script-like content

## Fix

- Update the Smart Cookie Kit plugin to a version later than `2.3.2`; the fixed version is not stated in the sources

## Timeline

- 2026-11-06T12:41:48+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-119178

## From the sources

The Smart Cookie Kit plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 2.3.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The payload is specifically crafted to survive wp_kses on save by storing hostile characters inside allowed HTML elements, with the attribute-breaking double-quote smuggled inside a permitted <code> body and reconstructed into a <abbr title> attribute only at render time by the plugin's own output buffer; exploitation requires an administrator to approve the comment and subsequently view the affected public post.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_