Cotonti through version 1.0.0 contains a reflected XSS vulnerability in message.php. The 'lng' parameter is improperly escaped before output in a confirmation dialog, enabling attackers to inject and execute arbitrary JavaScript code in the context of the victim's browser session. This vulnerability is exploitable without authentication by tricking users into clicking crafted links.

Successful exploitation allows attackers to execute arbitrary JavaScript in the victim's browser, potentially leading to session hijacking, defacement, or other client-side attacks. The vulnerability affects confidentiality and integrity but does not impact availability. The CVSS 3.1 base score is 6.1 (medium severity), reflecting network attack vector, low attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

No official patch or fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should avoid clicking suspicious links containing the 'lng' parameter in Cotonti message.php. Implementing web application firewall (WAF) rules to detect and block malicious payloads targeting this parameter may help mitigate risk.