---
id: CVE-2026-100521
title: >-
  Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability
  in the search plugin highlight parameter that performs no HTML or JavaScript
  escaping
summary: >-
  Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability
  in the search plugin highlight parameter that performs no HTML or JavaScript
  escaping. Attackers can craft malicious links with injected JavaScript in the
  high…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cwe:
  - CWE-79
vendor: Cotonti
product: Cotonti
affected:
  - Cotonti <= 1.0.0
published: '2026-09-26'
updated: '2026-09-26'
sourceUpdated: '2026-09-26T01:17:00.650'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-100521'
references:
  - url: 'https://github.com/Cotonti/Cotonti'
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.header.php
    label: disclosure@vulncheck.com
  - url: >-
      https://github.com/Cotonti/Cotonti/blob/1.0.0/plugins/search/search.page.first.php
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Cotonti/Cotonti/issues/1907'
    label: disclosure@vulncheck.com
  - url: 'https://github.com/Cotonti/Cotonti/pull/1908'
    label: disclosure@vulncheck.com
  - url: >-
      https://www.vulncheck.com/advisories/cotonti-through-1.0.0-reflected-xss-via-search-highlight-parameter
    label: disclosure@vulncheck.com
tags:
  - nvd
  - cve.org
ingestedAt: '2026-09-26T01:24:36.886Z'
---

## Overview

Cotonti through 1.0.0 contains a reflected cross-site scripting vulnerability in the search plugin highlight parameter that performs no HTML or JavaScript escaping. Attackers can craft malicious links with injected JavaScript in the highlight parameter that executes in the browser of any visitor who opens the link, including administrators.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.