CVE-2026-9811 Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector
Authenticated users can inject scripts via project names, leading to session hijacking and data access for administrators.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2026-9811?
CVE-2026-9811 is a medium-severity cross-site scripting vulnerability in mautic/core, published on 29 May 2026. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project's name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.
Weakness: CWE-79
Which versions are affected by CVE-2026-9811?
2 open source packages ship an affected version, including mautic/core.
| Package | Affected | Fixed in |
|---|---|---|
mautic/core Packagist | From 7.0.0 | 7.1.2 |
mautic/core Packagist | From 7.0.0 | 7.1.2 |
How do I fix CVE-2026-9811?
Upgrade mautic/core to 7.1.2 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2026-9811 being exploited?
There is no known exploitation of CVE-2026-9811 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Sources
Also known as GHSA-5hvg-w58j-545m.