CyberRota Analysis
AI-GeneratedThe vulnerability exists in the public contact form of 299Ko's plugin, where raw POST field values are inserted into the page template without proper sanitization, leading to reflected cross-site scripting (XSS). This allows unauthenticated attackers to execute malicious scripts in the context of users who interact with the form, potentially compromising session tokens and sensitive information. Organizations using this plugin should prioritize remediation to protect against potential exploitation, especially those with administrative access to the affected forms.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
299Ko's public contact form (plugin/contact/controllers/ContactController.php, home) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine's variable output function (common/Template.php, _show_var) echoes values with no htmlspecialchars call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea.