Vulnerability Description
Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators.
CVSS Score
MEDIUM
Related Weaknesses (CWE)
References
- https://github.com/Cotonti/Cotonti
- https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.header.php
- https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.page.first.p
- https://github.com/Cotonti/Cotonti/issues/1907
- https://github.com/Cotonti/Cotonti/pull/1908
- https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-sea
FAQ
What is CVE-2026-100521?
CVE-2026-100521 is a vulnerability with a CVSS score of 6.1 (MEDIUM). Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links...
How severe is CVE-2026-100521?
CVE-2026-100521 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2026-100521?
Check the references section above for vendor advisories and patch information. Review vendor security bulletins for remediation guidance.