The vulnerability in 299Ko's contact form (plugin/contact/controllers/ContactController.php, home()) involves setting raw POST parameters (name, firstname, email, message) directly into the page template without sanitization. The template engine's output function (common/Template.php, _show_var()) does not apply htmlspecialchars() or equivalent escaping, causing these values to be output unescaped in HTML attributes and textarea elements in contact.tpl. This allows an unauthenticated attacker to craft payloads such as name="><script>alert(document.domain)</script> to trigger reflected XSS when the form is submitted or auto-submitted by a victim, enabling session token theft or other script-based attacks.

Successful exploitation allows an unauthenticated attacker to execute arbitrary JavaScript in the context of users interacting with the vulnerable contact form, including administrators. This can lead to session token theft and other client-side attacks. The vulnerability is classified as reflected XSS with a CVSS 3.1 score of 6.1 (medium severity), indicating limited but significant impact on confidentiality and integrity without affecting availability.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is provided, users should consider implementing input sanitization or output encoding on the affected fields in the contact form to prevent injection of malicious scripts. Additionally, applying web application firewall (WAF) rules to detect and block XSS payloads may help mitigate exploitation risk.