This vulnerability involves improper neutralization of input during web page generation (CWE-79) in Mautic 7.0.0. Specifically, the project selector component fails to sanitize project names returned via AJAX before injecting them as option fields in the DOM. An attacker with authenticated access and project creation rights can embed malicious JavaScript in a project name. When an administrative user later accesses an entity editor with the project selector, the script executes in their browser context, potentially allowing session hijacking or unauthorized data access. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact.

An attacker with authenticated access and permission to create projects can inject malicious scripts into project names. These scripts execute in the browsers of administrative users who open entity editors with the project selector, potentially enabling session hijacking, unauthorized state manipulation, or access to sensitive organizational data within the Mautic dashboard. There is no indication of availability impact. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict project creation permissions to trusted users only and consider monitoring for suspicious project names. Avoid opening entity editors with the project selector component from untrusted sessions. Follow vendor updates for any official patches or mitigations.