CVE-2026-100522: Cotonti through 1.0.0 Reflected XSS via message.php lng parameter

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-09-26 · updated 2026-09-28
Weakness: CWE-79

Description

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in message.php where the lng parameter is not properly escaped before output in the confirmation dialog. Unauthenticated attackers can craft malicious links with script payloads in the lng parameter to execute arbitrary JavaScript in victim browser sessions.

Affected products

Cotonti: through 1.0.0

References

https://github.com/Cotonti/Cotonti
https://github.com/Cotonti/Cotonti/blob/1.0.0/message.php
https://github.com/Cotonti/Cotonti/issues/1907
https://github.com/Cotonti/Cotonti/pull/1908
https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-message-php-lng-parameter

Get alerted when CVE-2026-100522 or the next vulnerability affects your stack