This vulnerability in Mettle sendportal (up to version 3.0.1) involves improper sanitization or validation of the 'content' parameter in the /webview/ component of the Campaign Handler. An attacker can remotely inject malicious scripts via this parameter, leading to cross-site scripting. The vulnerability was responsibly disclosed but remains unpatched as the vendor has not responded. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction required, and limited impact on confidentiality and integrity.

Successful exploitation allows remote attackers to execute arbitrary scripts in the context of the affected web application, potentially leading to session hijacking, defacement, or other client-side attacks. The impact is limited to the confidentiality and integrity of user interactions with the affected component. There are no known exploits in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since the vendor has not responded and no official fix is available, users should consider implementing temporary mitigations such as input validation or output encoding on the 'content' parameter if possible. Monitor official channels for updates or patches from Mettle.