CVE-2026-100521: Cotonti through 1.0.0 Reflected XSS via search highlight parameter

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-26 · updated 2026-09-29
Weakness: CWE-79

Description

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators.

Affected products

Cotonti: through 1.0.0

References

https://github.com/Cotonti/Cotonti
https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.header.php
https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.page.first.php
https://github.com/Cotonti/Cotonti/issues/1907
https://github.com/Cotonti/Cotonti/pull/1908
https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-search-highlight-parameter

Get alerted when CVE-2026-100521 or the next vulnerability affects your stack