CVE-2026-49977Medium· 4.3▾ Sunlittarteaucitron: data-cookie attribute can be used to delete arbitrary cookies
▾ Sunlit zone — Low / medium · no exploitation signal
impact 23.7 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Aug 2.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via GHSA
0.2%
0.2% → 0.4%
tarteaucitron provides a list of cookies and buttons to delete them. If an attacker can write HTML with data attributes, they could create an element that silently deletes a cookie when clicked and trick a user to delete this cookie.
tarteaucitron.cookie.purge() is called on any element with the purgeBtn class. It does not check if the element is a legitimate tarteaucitron button or if the cookie corresponds to a service handled by tarteaucitron.
<a class="purgeBtn" data-cookie="foo">Click me!</a>
If someone has a cookie with this name and clicks on the link, the cookie is silently deleted.
The impact is limited because this only works on cookies without HttpOnly=true and the attacker has to know the name of the cookie.
tarteaucitronjs < 1.33.0Upgrade to a patched release:
tarteaucitronjs 1.33.0Connected by shared product, vendor, weakness, or advisory.
CVE-2026-115477High· 7.1obsidian-tc: Declined human-in-the-loop confirmations can permit destructive calls over HTTP
CVE-2025-12720Medium· 5.3The g-FFL Cockpit plugin for WordPress is vulnerable to unauthorized modification of data due to IP-based authorization that can be spoofed in the handle_enqueue_only() function in all versions up to, and including, 1.7.1
CVE-2025-12505Medium· 5.4The weDocs plugin for WordPress is vulnerable to unauthorized access in all versions up to, and including, 2.1.14
CVE-2025-10278Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization
CVE-2025-10275Medium· 6.3YunaiV yudao-cloud transfer improper authorization
CVE-2025-10276Medium· 6.3YunaiV ruoyi-vue-pro transfer improper authorization