What is GHSA-q9vr-qv9h-hj5f?

GHSA-q9vr-qv9h-hj5f is a security advisory published by GitHub Security Advisories with Medium severity. The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie...

Which CVE IDs does GHSA-q9vr-qv9h-hj5f cover?

GHSA-q9vr-qv9h-hj5f covers the following CVE IDs: CVE-2026-104719. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-q9vr-qv9h-hj5f?

GHSA-q9vr-qv9h-hj5f has a CVSS v3 base score of 6.4, published by GitHub Security Advisories.

GHSA-q9vr-qv9h-hj5fMediumCVSS 6.4

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie...

Vendor

GitHub Security Advisories

Published

November 4, 2026

Last Modified

November 4, 2026

🔗 CVE IDs covered (1)

CVE-2026-104719 →

📋 Description

The CookieYes WordPress plugin before 3.5.8 does not correctly restrict who can write its cookie-category script fields, and does not sanitize or escape them, allowing users with the Contributor role to store JavaScript that executes in the browsers of site visitors and of an administrator reviewing the content.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-104719
https://wpscan.com/vulnerability/fd1e087e-99b2-4942-82ee-44160ad77151
https://github.com/advisories/GHSA-q9vr-qv9h-hj5f