Cotonti CMS EUVD-2026-87376

Exploitation requires the target Cotonti site to have the search plugin enabled (default component) and the attacker must induce a victim to click a crafted URL whose 'highlight' parameter contains injected JavaScript - the reflected payload only executes in that victim's browser. No authentication is required to generate or send the link (PR:N), but the required user interaction (UI:A) is the key limiting factor: an unopened link causes no harm. Impact is amplified only if the tricked victim is an authenticated administrator, enabling session/action abuse in the admin context. Affects Cotonti versions through 1.0.0 prior to the PR #1908 fix.

This is a reflected cross-site scripting flaw (CWE-79) in the Cotonti CMS search plugin, where the 'highlight' parameter is echoed without HTML/JavaScript escaping. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N, score 5.1) is internally consistent with a classic reflected XSS: network-reachable and low-complexity, but gated by required victim interaction (UI:A) and delivering only limited subsequent-system confidentiality/integrity impact (SC:L/SI:L) - no impact to the vulnerable system's own data (VC/VI/VA:N). This is a real but moderate issue rather than a critical one: exploitation is unauthenticated to launch but depends entirely on tricking a victim (potentially an administrator) into opening a crafted link, so it is opportunistic/social-engineering-driven, not wormable or server-compromising on its own. No EPSS score was provided, the CVE is not in CISA KEV, and no public exploit code is referenced - signals of low real-world exploitation pressure. The primary escalation concern is session/credential theft or admin-context action if an administrator opens the malicious link, which could pivot toward account takeover; treat as medium priority for internet-facing Cotonti sites, low priority otherwise.

An attacker crafts a URL to a Cotonti site's search feature with malicious JavaScript embedded in the 'highlight' parameter and delivers it via phishing, forum post, or messaging to a site administrator or user. When the victim opens the link, the unescaped payload reflects into the page and executes in their browser session, allowing the attacker to steal session cookies or perform actions in the victim's authenticated context. No public exploit code is identified at time of analysis, but the injection point and payload construction are straightforward.