CVE-2026-100521

Name of the Vulnerable Software and Affected Versions Cotonti version 1.0.0

Description A reflected cross-site scripting issue exists in the search plugin. The application fails to perform HTML or JavaScript escaping on the highlight parameter. This allows attackers to create malicious links containing injected JavaScript that executes in the browser of any user who opens the link, including those with administrator privileges.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the highlight parameter in the search plugin until the issue is resolved.