CVE-2026-9811: Mautic has Stored Cross-Site Scripting (XSS) in Project Option Selector

July 2, 2026

A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application fails to sanitize project names returned via AJAX before injecting them into the DOM as option fields. An authenticated user with permissions to create projects can exploit this to store a malicious script payload in the project’s name.

References

github.com/advisories/GHSA-5hvg-w58j-545m
github.com/mautic/mautic/security/advisories/GHSA-5hvg-w58j-545m
nvd.nist.gov/vuln/detail/CVE-2026-9811

Code Behaviors & Features

Detect and mitigate CVE-2026-9811 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →