CookieYes vulnerabilities

CVEs whose affected-version data names the CookieYes package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-104719Medium· 6.4

4d ago

CookieYes < 3.5.8 - Contributor+ Stored XSS via Cookie Category Scripts

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in…

▾ SunlitEPSS 0.31%via CVEORG