CVEvulnerability
CVE-2026-100521
5.1 MEDIUM
Official page ↗
- Status
- Deferred
- Published
- 2026-09-26
- Last modified
- 2026-09-29
- Assigner
- [email protected]
- CVSS 4.0 ([email protected])
- 5.1 MEDIUM — CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- Weaknesses
- CWE-79
Description
Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators.
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://github.com/Cotonti/Cotonti github.com
- https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.header.php github.com
- https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.page.first.php github.com
- https://github.com/Cotonti/Cotonti/issues/1907 github.com
- https://github.com/Cotonti/Cotonti/pull/1908 github.com
- https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-search-highlight-parameter www.vulncheck.com