This vulnerability affects Mettle sendportal up to version 3.0.1 in the Campaign Handler's /webview/ component. Specifically, the 'content' argument can be manipulated to inject malicious scripts, resulting in cross-site scripting. The vulnerability can be exploited remotely without authentication. Although the issue was reported early to the project, no official fix or remediation has been released. The CVSS 4.0 base score is 5.1, indicating medium severity with network attack vector, low attack complexity, no privileges required, and user interaction needed.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the affected application, potentially leading to session hijacking, defacement, or other client-side impacts. The vulnerability is exploitable remotely and requires user interaction. There is no indication of privilege escalation or direct impact on server integrity from the provided data.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Since no official fix or temporary mitigation is available from the vendor, users should consider applying application-level input validation or sanitization on the 'content' parameter as a temporary measure. Monitor vendor channels for updates and apply patches promptly once released.