CVE-2026-115193High· 8.2▾ TwilightA stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a fi…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 45.1 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Stakeholder-Specific Vulnerability Categorization from CISA's ADP record at CVE.org: whether exploitation is observed, whether an attack can be automated, and how much of the system is at stake. The CVSS score shown above comes from the assigning CNA record, not NVD.
A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field (for example, through contact editing, the contact API, or a form submission mapped to the field) can store a script payload in it. When another user, including an administrator, opens the affected contact's detail page, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, such as creating new administrator accounts, altering system configuration, or accessing contact and campaign data.
mautic/core >= 7.0.0 < 7.2.2Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
There are no official workarounds. To mitigate this vulnerability without upgrading, restrict contact create and edit permissions and API access to trusted users, and avoid mapping public form fields or publicly updatable settings to HTML-type contact fields.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-9809High· 7.6Mautic has Stored Cross-Site Scripting (XSS) in Projects Component
CVE-2026-9811Medium· 5.4Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
CVE-2026-115191High· 7.1A SQL injection vulnerability exists in a contact lookup AJAX endpoint of the Mautic administration interface (/s/ajax)
CVE-2026-115192High· 7.1An SQL Injection vulnerability exists in the dashboard widget data API endpoint (/api/data/{type})
CVE-2026-115188Critical· 9.9An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7
CVE-2026-115189High· 8.8A server-side template injection vulnerability exists in the Twig theme rendering sandbox of Mautic