CVE-2026-9811 Details

A stored Cross-Site Scripting (XSS) vulnerability has been identified in the project selector component of Mautic version 7. The issue arises because the application does not properly sanitize project names returned via AJAX before injecting them into the DOM as option fields. This vulnerability can be exploited by an authenticated user with project creation permissions, allowing them to inject a malicious script payload into the project's name. When another administrative user opens an entity editor with the project selector, the injected script executes in their browser session, potentially hijacking the session, performing unauthorized actions, or accessing organizational data on the dashboard.

Users can upgrade to Mautic version 7.1.2 to address this vulnerability. For those using earlier versions of Mautic 7, it is recommended to restrict project creation and modification permissions to trusted administrative users.