Stored Cross-Site Scripting in Smart Cookie Kit Plugin for WordPress

CVE-2026-119178

What is CVE-2026-119178?

The Smart Cookie Kit plugin for WordPress exhibits a Stored Cross-Site Scripting vulnerability in the 'comment' parameter. Insufficient input sanitization and output escaping allows unauthenticated attackers to inject arbitrary scripts into web pages accessed by users, leading to potential exposure to malicious attacks. Specifically, the exploit involves creating a payload that evades wp_kses on save by carefully disguising harmful characters within permitted HTML elements. This method allows the hostile content to be rendered at a later time when the comment is approved by an administrator and displayed on a public post, compromising user security.

References