299Ko’s public contact form accepts user input for name, firstname, email and message but inserts these fields into the page template without escaping. The template’s rendering function outputs the values directly into an HTML attribute and a textarea, allowing an unauthenticated attacker to inject arbitrary script code. A payload such as name=\">\<script>alert(document.domain)</script> will be reflected to the visitor’s browser, permitting session cookie theft or other client‑side attacks. The weakness is a classic reflected XSS scenario (CWE‑79).

All installations of the 299Ko plugin that include the default public contact form are affected; specific version information is not disclosed. The vulnerability exists wherever the plugin’s ContactController is deployed in its default configuration.

With a CVSS score of 6.1 the vulnerability is considered of moderate severity. No EPSS score is available, and the issue is not listed in CISA’s KEV catalog, indicating limited publicly known exploitation. An attacker can exploit the flaw remotely over the network by simply submitting the form, making it a high‑risk vulnerability for any attacker capable of delivering a crafted payload to a victim’s browser. The impact largely affects confidentiality and availability of user sessions through token theft.