CVE-2026-115193

Name of the Vulnerable Software and Affected Versions Mautic version 7

Description A stored Cross-Site Scripting (XSS) issue exists in the contact detail view. HTML-type custom contact fields are rendered without output sanitization, allowing a user or integration to store a script payload via contact editing, the contact API, or form submissions mapped to the field. When an administrator or another user views the affected contact's detail page, the script executes in their browser session. This can lead to unauthorized administrative actions, including the creation of new administrator accounts, modification of system configurations, or unauthorized access to campaign and contact data.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.