CVE-2026-9811

A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project's name. When another administrative user subsequently opens an entity editor containing the project selector, the injected script executes within the context of their active browser session. This could allow an attacker to hijack the session, perform unauthorized state coordination, or access organizational data within the dashboard.

• CWE-79

• https://github.com/mautic/mautic/security/advisories/GHSA-5hvg-w58j-545m

Published

May 29, 2026

Last Modified

Jul 21, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-9804A flaw was found in KubeVirt's virt-exportserver component. …7.7
• CVE-2026-9806A stored cross-site scripting (XSS) vulnerability exists in …6.3
• CVE-2026-9807GitLab has remediated an issue in GitLab CE/EE affecting all…4.3
• CVE-2026-9808An authorization bypass vulnerability exists in the Mautic 7…7.1
• CVE-2026-9809A stored Cross-Site Scripting (XSS) vulnerability exists in …7.6
• CVE-2026-9810The AI Copilot WordPress plugin before 1.5.4 does not bind …9.8
• CVE-2026-9813FlowIntel up to version 3.3.0 contains a server-side request…9.9
• CVE-2026-9815The MagicForm WordPress plugin through 0.1.3 does not proper…6.5
• CVE-2026-9818Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2026-9820Mattermost versions 11.7.x <= 11.7.2, 10.11.x <= 10.11.19 fa…3.8
• CVE-2026-9822The WP Hotel Booking WordPress plugin before 2.3.1 does not …6.5
• CVE-2026-9824Mattermost versions 11.7.x <= 11.7.2, 11.6.x <= 11.6.4, 10.1…4.3