CVE-2026-100521CWE-79cross-site-scripting

CVE-2026-100521

Medium · published September 26, 2026

CVSS v3.1
6.1
EPSS
0%
Percentile
9.4
In the wild
Unconfirmed
What it is

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators.

The record
Technical detail
CVSS v3.1
6.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS v4.0
5.1 · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00201 · 9.4th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-09-26T05:17Z
References (6)
https://github.com/Cotonti/Cotonti · [email protected]https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.header.php · [email protected]https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.page.first.php · [email protected]https://github.com/Cotonti/Cotonti/issues/1907 · [email protected]https://github.com/Cotonti/Cotonti/pull/1908 · [email protected]https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-search-highlight-parameter · [email protected]
EPSS history
Timeline
  • 27 SEP 03:24Z
    EPSS moved — → 0%
    epss
  • 26 SEP 00:59Z
    Cotonti through 1.0.0 Reflected XSS via search highlight parameter
    cvelistv5