Mautic stored Cross-site Scripting (XSS)

published 2021-01-19 5 y ago modified 2026-06-17 4 mo ago also GHSA-3px5-wjh3-9x6r , EUVD-2022-2228

cvss: 9.0; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.0%; EPSS 1.0% chance of exploitation in 30 days, percentile 63%
public exploits: 0; none known

Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could load an externally drafted JavaScript file that would allow them to eventually perform actions on the target user’s behalf, including changing the user’s password or email address or changing the attacker’s user role from a low-privileged user to an administrator account.

Patch / fix

fixed in 2

packagist mautic/core 3.2.4
mautic mautic 3.2.4

Exploit prediction

1.02% chance of exploitation in the next 30 days, higher than 63% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by	version	score	vector
NVD	3.1	9.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
NVD	2.0	6.0	AV:N/AC:M/Au:S/C:P/I:P/A:P
GitHub	3.1	9.0	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H

Affected packages

ecosystem	package	affected	fixed in
packagist	mautic/core	<3.2.4	3.2.4

Classification

Weakness

CWE-79 Improper Neutralization of Input During Web Page Generation

References

forum.mautic.org /c/announcements/16
web, vendor-advisory
labs.bishopfox.com /advisories/mautic-version-3.2.2
web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2020-35129
advisory
github.com /mautic/mautic
package

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary