CVE-2026-9809

CVE-2026-9809 CVE-2026-9809 is a Stored Cross-Site Scripting Stored XSS vulnerability affecting Mautic 7 versions 7.0.0 through 7.1.1. The flaw exists in the Projects component, where project names are displayed as tags and hover popovers on administrative pages such as campaigns, emails, and for...

CVE-2026-115193

A stored Cross-Site Scripting XSS vulnerability exists in the contact detail view of Mautic 7. Values of HTML-type custom contact fields are rendered without output sanitization. A user or integration able to write a value to such a field for example, through contact editing, the contact API, or ...

CVE-2026-115193

A stored Cross-Site Scripting (XSS) vulnerability exists in the contact detail view of Mautic 7 . The root cause is the lack of output sanitization when rendering values from HTML-type custom contact fields . An attacker can inject a script payload by submitting a form, using the contact API, or ...

CVE-2026-115188

An unrestricted file upload vulnerability exists in the campaign import feature of Mautic 7. When processing an uploaded campaign archive, the application copies the bundled asset files into a publicly accessible media directory without restricting their file names or types. An authenticated user...