CVE-2026-71249: 299Ko: Unauthenticated Reflected XSS in Public Contact Form
299Ko's public contact form (plugin/contact/controllers/ContactController.php, home()) sets raw POST field values (name, firstname, email, message) into the page template with no sanitization. The template engine's variable output function (common/Template.php, showvar()) echoes values with no htmlspecialchars() call, and the sink template (contact.tpl) outputs these values unescaped into an HTML attribute and a textarea. An unauthenticated attacker can submit a payload such as name="><script>alert(document.domain)</script> to achieve reflected XSS against any visitor who submits or is tricked into auto-submitting the form, including a targeted administrator, enabling session token theft.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Update contact.tpl so that the variables populated from POST fields (name, firstname, email, message) are output using escaping (the template variable output currently reflects them into HTML attributes and a textarea with no htmlspecialchars()).
299Ko contact form template output (contact.tpl) HTML escaping for reflected variables = Use escaped output (e.g., ensure htmlspecialchars()/equivalent is applied) instead of unescaped printing in HTML attributes and <textarea>
Event History
Frequently Asked Questions
What is the severity of CVE-2026-71249?
CVE-2026-71249 has a medium severity score of 6.1.
What type of vulnerability is CVE-2026-71249?
CVE-2026-71249 is classified as an unauthenticated reflected cross-site scripting (XSS) vulnerability.
How do I fix CVE-2026-71249?
To fix CVE-2026-71249, ensure that user inputs in the public contact form are properly sanitized before being rendered in the template.
What software is affected by CVE-2026-71249?
CVE-2026-71249 affects the 299Ko public contact form software.
When was CVE-2026-71249 published?
CVE-2026-71249 was published on August 5, 2026.