CVE-2026-9809

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads. When an administrative user views an entity associated with a compromised project and hovers over its tag, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, alter system configurations, or exfiltrate sensitive data.

• CWE-79

• https://github.com/mautic/mautic/security/advisories/GHSA-7h65-whp7-rgqf

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9802A flaw was found in Keycloak. When revokeRefreshToken=true i…6.8
• CVE-2026-9803A flaw was found in Keycloak's ClientRegistrationAuth compon…5.3
• CVE-2026-9804A flaw was found in KubeVirt's virt-exportserver component. …7.7
• CVE-2026-9806A stored cross-site scripting (XSS) vulnerability exists in …6.3
• CVE-2026-9807GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-9808An authorization bypass vulnerability exists in the Mautic 7…7.1
• CVE-2026-9810The AI Copilot WordPress plugin before 1.5.4 does not bind …9.8
• CVE-2026-9811A stored Cross-Site Scripting (XSS) vulnerability exists in …5.4
• CVE-2026-9813FlowIntel up to version 3.3.0 contains a server-side request…9.9
• CVE-2026-9815The MagicForm WordPress plugin through 0.1.3 does not proper…6.5
• CVE-2026-9818Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-9820Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fa…3.8