Reflected Cross-Site Scripting Vulnerability in Cotonti Search Plugin
CVE-2026-100521

5.1MEDIUM

Key Information:

Vendor

Cotonti

Status
Cotonti
Vendor
CVE Published:
26 September 2026

What is CVE-2026-100521?

The Cotonti platform contains a reflected cross-site scripting vulnerability within its search plugin. Specifically, the highlight parameter lacks proper HTML and JavaScript escaping, enabling attackers to craft malicious links that inject JavaScript code. When visitors, including administrators, click these crafted links, the code executes in their browsers, potentially compromising user sessions and sensitive information. Web administrators using Cotonti should update to patched versions to mitigate this vulnerability.

Affected Version(s)

Cotonti 0 <= 1.0.0

References

https://github.com/Cotonti/Cotonti/issues/1907
issue-tracking
https://github.com/Cotonti/Cotonti/pull/1908
issue-trackingpatch
https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/sea...
technical-description

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Harsh Raj Singhania
.