CVE-2026-71249

Name of the Vulnerable Software and Affected Versions 299Ko (affected versions not specified)

Description An unauthenticated attacker can perform a reflected Cross-Site Scripting (XSS) attack via the public contact form. The issue occurs because the home() function in plugin/contact/controllers/ContactController.php assigns raw POST field values to the page template without sanitization. Subsequently, the show var() function in common/Template.php echoes these values without using htmlspecialchars(), and the contact.tpl template outputs them unescaped into a textarea and an HTML attribute. This allows an attacker to execute malicious scripts in the browser of a visitor or administrator, potentially leading to session token theft. The vulnerable parameters are name, firstname, email, and message.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.