CVE-2026-26483 describes a stored XSS vulnerability in Mettle SendPortal up to version 3.0.1. The flaw exists in the template management functionality where user-supplied input in the content parameter of the /templates endpoint is not properly sanitized. This enables attackers to persistently inject malicious JavaScript code, which executes in the context of users accessing the compromised templates, potentially leading to session hijacking or other client-side attacks.

Successful exploitation allows an attacker to inject persistent malicious scripts into templates, which execute in the browsers of users who access those templates. This can lead to unauthorized actions performed on behalf of users, theft of sensitive information, or other client-side impacts typical of stored XSS vulnerabilities.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should apply strict input validation and output encoding on the content parameter in the /templates endpoint if possible. Avoid using untrusted templates and restrict access to template management functionality to trusted users only.