CVE-2026-9811: Mautic Core Stored XSS Vulnerability in Project Option Selector
Summary
CVE-2026-9811: Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector. Affects mautic/core versions >= 7.0.0, < 7.1.2. Fixed in 7.1.2. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Mautic is an open-source marketing automation platform that enables businesses to manage their marketing campaigns and customer relationships effectively. It provides features such as email marketing, landing pages, and lead management. The platform's project option selector is a component that allows users to associate projects with various system entities. However, a vulnerability in this component has been identified, which could lead to security risks if not addressed.
Vulnerability Detail
A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project's name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.
How To Fix
Minimum fixed version
7.1.2
This is the first release that contains the fix.
composer require mautic/core:7.1.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no official workarounds available. However, to mitigate this vulnerability without upgrading, restrict project creation and modification permissions to trusted administrative users.
Conclusion
The stored XSS vulnerability in Mautic's project option selector poses significant risks to users, particularly administrative users. It is crucial to update to the patched version 7.1.2 or later to mitigate these risks effectively. Additionally, restricting permissions for project creation can help reduce exposure until the update is applied.
See every vulnerability recorded for mautic/core →
FAQ
The vulnerability is a stored Cross-Site Scripting (XSS) issue that allows an attacker to inject malicious scripts into project names.
An authenticated user with permissions to create projects can exploit this vulnerability.
The vulnerability can lead to session hijacking, unauthorized state coordination, and access to sensitive organizational data.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
The CVSS score of this vulnerability is 5.4, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for mautic/core.
