CVE-2026-71249

CVE-2026-71249 affects 299Ko’s public contact form. The vulnerability arises in the plugin/contact/controllers/ContactController.php (home()) where raw POST fields (name, firstname, email, message) are inserted into the page template without sanitization. The template engine’s _show_var() echoes ...