CVE-2025-9823: Mautic Core Reflected XSS Vulnerability in Lead Tagging
Summary
CVE-2025-9823: Mautic vulnerable to reflected XSS in lead:addLeadTags - Quick Add. Affects mautic/core across 3 version ranges.
>= 4.4.0, < 4.4.17
>= 5.0.0-alpha, < 5.2.8
>= 6.0.0-alpha, < 6.0.5
Fixed in 4.4.17, 5.2.8 or 6.0.5, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation platform that enables businesses to manage their marketing campaigns and customer interactions effectively. It provides features such as email marketing, lead management, and campaign tracking. However, Mautic has a vulnerability in its core functionality that allows for reflected Cross-Site Scripting (XSS) attacks, particularly in the lead tagging feature.
Vulnerability Detail
The vulnerability is a reflected Cross-Site Scripting (XSS) issue that arises from improper handling of user-supplied input in the 'Tags' input field on the /s/ajax?action=lead:addLeadTags endpoint. When a user submits tags, the server reflects this input back in the response without adequate sanitization or escaping. This flaw allows an attacker to execute arbitrary JavaScript in the context of another user's session, potentially leading to session hijacking, credential theft, or unauthorized actions within the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 4.4.0, < 4.4.174.4.17composer require mautic/core:4.4.17 -
>= 5.0.0-alpha, < 5.2.85.2.8composer require mautic/core:5.2.8 -
>= 6.0.0-alpha, < 6.0.56.0.5composer require mautic/core:6.0.5
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, users can implement input validation and sanitization on the client side to prevent malicious scripts from being executed. However, this is not a substitute for updating to the patched version of the software.
Conclusion
The reflected XSS vulnerability in Mautic's lead tagging feature poses significant risks to user security. It is crucial for users to update to the latest patched versions of the Mautic core package to protect against potential attacks. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mautic/core →
FAQ
The vulnerability is a reflected XSS that allows attackers to execute JavaScript in the context of another user's session.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
Attackers can steal sensitive user data, hijack sessions, redirect users to malicious sites, and perform unauthorized actions within the application.
Yes, patches are available in versions 4.4.17, 5.2.8, and 6.0.5 of the Mautic core package.
Implement client-side input validation and sanitization as a temporary workaround until you can update to a patched version.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
