This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Mautic 7.0.0. Specifically, user-supplied project names are not sanitized when displayed as tags and popovers in administrative views such as campaigns, emails, or forms. An authenticated user with permissions to create or edit projects can inject malicious JavaScript payloads. When an administrative user interacts with these tags, the script executes within their browser session, potentially allowing privilege escalation through administrative actions or sensitive data theft. The CVSS 3.1 base score is 7.6 (High), reflecting network attack vector, low attack complexity, required privileges, and user interaction, with impact on confidentiality and integrity but not availability.

Successful exploitation can lead to execution of arbitrary scripts in the context of administrative users, enabling attackers to perform unauthorized administrative actions, modify system configurations, or exfiltrate sensitive information. The vulnerability requires an authenticated user with project creation or editing permissions to inject the payload, and an administrative user to trigger the script by viewing or hovering over the compromised project tag.

No official patch or remediation is currently available for this vulnerability. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is released, restrict project creation and editing permissions to trusted users only and educate administrative users to avoid interacting with suspicious project tags. Monitor vendor communications for updates on patches or official mitigations.