Stored XSS in Mautic Projects Component Enables Script Injection

A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or forms), user-supplied project names are rendered without proper sanitization. An authenticated user with permissions to create or edit projects can exploit this to inject malicious script payloads. When an administrative user views an entity associated with a compromised project and hovers over its tag, the injected script executes within the context of their active browser session. This could allow an attacker to perform administrative actions on behalf of the victim, alter system configurations, or exfiltrate sensitive data.

Casky was already ahead

This CVE exploits attack patterns that Casky's 301matched skills already investigate — long before this vulnerability was disclosed. Claude's reasoning model maps these techniques to MITRE ATT&CK, so practitioners who ran these skills have already seen the threat behaviour in their findings.

Analysis

This vulnerability is a stored Cross-Site Scripting (XSS) flaw in Mautic 7's Projects component that allows authenticated users to inject malicious scripts through unsanitized project names. When administrative users view entities (campaigns, emails, forms) associated with compromised projects—particularly when hovering over popovers—the injected scripts execute in their browser context. This matters because it enables privilege escalation and lateral movement within Mautic instances: a lower-privileged user can compromise administrative sessions, steal credentials, modify configurations, or inject persistent malware. Organizations using Mautic for marketing automation are affected, especially those with multi-user environments where project creation permissions are delegated.

Casky's 301 matching skills detect this attack pattern by mapping to MITRE ATT&CK TA0001 (Reconnaissance) and TA0043 (Reconnaissance) techniques, identifying both the initial reconnaissance phase where attackers probe for sanitization weaknesses and the execution phase of injected payloads. Practitioners using Casky would see findings highlighting: (1) unsanitized user input flows in project naming functions, (2) DOM-based and stored payload execution vectors in administrative UI components, (3) missing Content Security Policy (CSP) headers that would block script execution, and (4) insufficient input validation before rendering project metadata in popover elements. The platform's extended reasoning capabilities would correlate these technical indicators with the CWE-79 classification, helping teams prioritize remediation and understand how attackers chain this vulnerability with privilege escalation techniques.

Live Threat IntelligenceComing soon

Casky Risk Score

—

EPSS Probability

—

Shodan Exposure

—

GreyNoise Signal

—

Composite risk scoring from EPSS, CISA KEV, Shodan, and GreyNoise — 21 security APIs correlated into a single Casky Risk Score. Coming in Casky Pro. Join early access →

301 Casky skills cover this attack pattern

These skills use Claude AI's reasoning model to surface findings in the same attack categories as CVE-2026-9809.

analyzing-apt-group-with-mitre-navigator

threat intelligence · low

Run

analyzing-campaign-attribution-evidence

threat intelligence · low

Run

analyzing-certificate-transparency-for-phishing

threat intelligence · low

Run

MITRE ATT&CK Techniques

TA0001 TA0043

Investigate the attack patterns behind CVE-2026-9809

Casky has 301 skills that investigate the attack patterns behind CVE-2026-9809. Run one and get CVSS-scored findings in 3 minutes.

Run the skill that detects this →

X Instagram LinkedIn