CVE-2026-71249 — 299Ko - Unauthenticated Reflected XSS in Public Contact Form

CVE-2026-71249

299Ko - Unauthenticated Reflected XSS in Public Contact Form PUBLISHED

Description (CNA)

299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine's variable output function (common/Template.php, _show_var) echoes values with no htmlspecialchars call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea.

Affected (CNA)

Vendor / product	Versions
299ko / 299Ko	affected 0

CWE

CWE-79

References

https://github.com/search?q=299ko&type=repositories

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.