Show Me The Cookies
Show Me The Cookies has one disclosed vulnerability in the WordSec catalog, all reported in 2025; it remains unpatched as of September 2026. Their average CVSS score is 7.3, and the most serious one scores 7.3 out of 10. Severity breakdown: 0 critical and 1 high.
The most common weakness is Code Injection, behind 1 of the records (100%).
The one issue recorded for Show Me The Cookies has no published fix yet, which makes virtual patching the only reliable mitigation. The oldest unresolved one dates back to 2025.
All of these findings were reported by Krzysztof Zając. Show Me The Cookies is installed on roughly 400 WordPress sites, so each unpatched flaw has a wide blast radius. The current release is tested up to WordPress 7.0.4.
CVE-2025-1509Show Me The Cookies <= 1.0 - Unauthenticated Arbitrary Shortcode Execution
Read the full analysisVulnerability Records
Show Me The Cookies
Author
Jay Versluis
Show Me The Cookies displays all current cookies your site is using. Once activated, you can find this list under Appearance – Cookies. You can also display this list to your visitors by placing the shortcode [cookies] into any post or page. WordPress uses several cookies under the hood by default. If you’d like to filter these out, use the shortcode [cookies-nowp], which will show a message if no non-WordPress cookies are found. This plugin is based on code by David Artiss, who kindly made it available on GitHub. To find out more about what cookies are and what can be done with them, please read https://en.wikipedia.org/wiki/HTTP_cookie
Vulnerability data © Defiant, Inc., provided under the Wordfence Intelligence T&C