299Ko’s public contact form allows users to submit values such as name, firstname, email and message. The plugin renders these inputs directly into the page template without any form of sanitization, enabling an attacker to inject arbitrary script code that is then reflected in the visitor’s browser. This reflected Cross‑Site Scripting flaw can be used to hijack session cookies or perform other client‑side attacks, and it is classified as a CWE‑79 vulnerability.

All installations of the 299Ko plugin that include the default public contact form are affected; specific version information is not disclosed. The vulnerability exists wherever the plugin’s ContactController is deployed in its default configuration.

With a CVSS score of 6.1 the vulnerability is considered of moderate severity. The EPSS score is below 1%, indicating a low probability of exploitation, and it is not listed in CISA’s KEV catalog. An attacker can exploit the flaw remotely over the network by simply submitting the form, making it a high‑risk vulnerability for any attacker capable of delivering a crafted payload to a victim’s browser. The impact largely affects confidentiality and availability of user sessions through token theft.