Insufficient Input Validation in CookieYes WordPress Plugin
CVE-2026-104719
Currently unrated
Key Information:
Badges
👾 Exploit Exists🟡 Public PoC
What is CVE-2026-104719?
The CookieYes WordPress plugin prior to version 3.5.8 fails to properly restrict access to its cookie-category script fields, allowing users with a Contributor role to inject unvalidated JavaScript. This vulnerability can lead to arbitrary code execution in the browsers of users and administrators, thereby compromising the integrity and security of the site. Proper input validation and sanitization practices are essential to prevent such script injection attacks.
Affected Version(s)
CookieYes 0 < 3.5.8
Exploit Proof of Concept (PoC)
PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.