Medium
CVE-2026-9811
A stored Cross-Site Scripting (XSS) vulnerability exists in the project selector component of Mautic 7. When rendering selection menus for associating projects with system entities, the application f…
Tag: Mautic
All CVEs associated with "Mautic". Page 1/1 • 51 CVEs.
About “Mautic”
A curated feed of “Mautic”-related CVEs appears below. We currently track 51 CVEs for this tag (all time). In the last 365 days, 9 were published. Average CVSS is 7.0 (all time; 7.4 over 365d), and 53% are rated High/Critical (all time). Top CWEs (last 365 days): CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'), CWE-89 - Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), CWE-863 - Incorrect Authorization.
In our taxonomy this topic maps to a LOW impact class. CMS and plugins expand attack surface. Patch core, themes, and plugins, remove abandoned extensions, restrict admin access, enable WAF, and keep backups. Use the filters below to sort by CVSS, risk and CWE. Each detail page highlights vendor advisories and mitigation tips.
Support & lifecycle: mautic
This table shows recent release cycles and their projected end-of-life. Data source: endoflife.date.
| Cycle | Release | Latest | Premier Support | Extended Support | EOL | LTS |
|---|---|---|---|---|---|---|
| 7.1 | 7.1.2 | Unavailable | Soon | |||
| 7.0 | 7.0.2 | Unavailable | Expired | |||
| 6.0 | 6.0.9 | Soon | LTS | |||
| 5.2 | 5.2.11 | Soon | LTS | |||
| 5.1 | 5.1.1 | Unavailable | Expired | |||
| 5.0 | 5.0.4 | Unavailable | Expired | |||
| 4.4 | 4.4.13 | Expired | ||||
| 4.3 | 4.3.1 | Unavailable | Expired | |||
| 4.2 | 4.2.2 | Unavailable | Expired | |||
| 4.1 | 4.1.2 | Unavailable | Expired | |||
| 4.0 | 4.0.2 | Unavailable | Expired | |||
| 3.3 | 3.3.5 | Unavailable | Expired | |||
| 3.2 | 3.3.2 | Unavailable | Expired | |||
| 3.1 | 3.1.2 | Unavailable | Expired | |||
| 3.0 | 3.0.2 | Unavailable | Expired | |||
| 2.16 | 2.16.5 | Unavailable | Expired | |||
| 2.15 | 2.15.3 | Unavailable | Expired |
Maintained Soon (≤ 180 days) Expired
Subscribe lifecycle: RSS · RSS (expired) · ICS
Subscribe CVEs: RSS for “Mautic” · RSS (High+Critical only)
CVEs tagged with this topic. Filters apply to the whole list (loaded from JSON).
CVSS ≥ 0.0
2026-05-29
High
CVE-2026-9809
A stored Cross-Site Scripting (XSS) vulnerability exists in the Projects component of Mautic 7. When displaying project tags and popovers on administrative detail views (such as campaigns, emails, or…
High
CVE-2026-9808
An authorization bypass vulnerability exists in the Mautic 7 API v2 endpoints (utilizing API Platform). Under certain conditions, roles configured with owner-scope restrictions (such as `viewown` or…
Critical
CVE-2026-9559
A path traversal vulnerability exists in the campaign import feature of Mautic 7. When extracting uploaded ZIP files during campaign imports, a flaw in the validation logic allows file paths to escap…
Critical
CVE-2026-9558
A Server-Side Template Injection (SSTI) vulnerability exists in Mautic's theme engine. The platform renders uploaded Twig templates without a sandbox or strict function restrictions. Authenticated us…
Medium
CVE-2026-9557
A Server-Side Request Forgery (SSRF) vulnerability exists in Mautic's Focus component. Due to insufficient validation of user-supplied URLs, an authenticated user can trigger outbound HTTP requests f…
High
CVE-2026-4776
An SQL injection vulnerability exists in Mautic's API contact filtering mechanism. Due to insufficient recursive sanitization of nested query parameters, an authenticated API user can bypass input fi…
2026-02-24
High
CVE-2026-3105
SummaryThis advisory addresses a SQL injection vulnerability in the API endpoint used for retrieving contact activities. A vulnerability exists in the query construction for the Contact Activity time…
2025-09-03
Medium
CVE-2025-9822
SummaryA user with administrator rights can change the configuration of the mautic application and extract secrets that are not normally available. ImpactAn administrator who usually does not have a…
2025-05-28
Medium
CVE-2025-5256
SummaryThis advisory addresses an Open Redirection vulnerability in Mautic's user unlocking endpoint. This vulnerability could be exploited by an attacker to redirect legitimate users to malicious we…
Medium
CVE-2024-47057
SummaryThis advisory addresses a security vulnerability in Mautic related to the "Forget your password" functionality. This vulnerability could be exploited by unauthenticated users to enumerate vali…
Medium
CVE-2024-47055
SummaryThis advisory addresses a security vulnerability in Mautic related to the segment cloning functionality. This vulnerability allows any authenticated user to clone segments without proper autho…
Medium
CVE-2025-5257
SummaryThis advisory addresses a security vulnerability in Mautic where unpublished page previews could be accessed by unauthenticated users and potentially indexed by search engines. This could lead…
Medium
CVE-2024-47056
SummaryThis advisory addresses a security vulnerability in Mautic where sensitive .env configuration files may be directly accessible via a web browser. This exposure could lead to the disclosure of…
2025-02-26
High
CVE-2024-47053
This advisory addresses an authorization vulnerability in Mautic's HTTP Basic Authentication implementation. This flaw could allow unauthorized access to sensitive report data. * Improper Authori…
Critical
CVE-2024-47051
This advisory addresses two critical security vulnerabilities present in Mautic versions before 5.2.3. These vulnerabilities could be exploited by authenticated users. * Remote Code Execution (RC…
2024-09-18
High
CVE-2022-25770
Mautic allows you to update the application via an upgrade script. The upgrade logic isn't shielded off correctly, which may lead to vulnerable situation. This vulnerability is mitigated by the fac…
Low
CVE-2024-47058
With access to edit a Mautic form, the attacker can add Cross-Site Scripting stored in the html filed. This could be used to steal sensitive information from the user's current session.
Medium
CVE-2024-47050
Prior to this patch being applied, Mautic's tracking was vulnerable to Cross-Site Scripting through the Page URL variable.
High
CVE-2022-25768
The logic in place to facilitate the update process via the user interface lacks access control to verify if permission exists to perform the tasks. Prior to this patch being applied it might be poss…
Medium
CVE-2022-25777
Prior to the patched version, an authenticated user of Mautic could read system files and access the internal addresses of the application due to a Server-Side Request Forgery (SSRF) vulnerability.
High
CVE-2022-25776
Prior to the patched version, logged in users of Mautic are able to access areas of the application that they should be prevented from accessing. Users could potentially access sensitive data such a…
Medium
CVE-2022-25775
Prior to the patched version, logged in users of Mautic are vulnerable to an SQL injection vulnerability in the Reports bundle. The user could retrieve and alter data like sensitive data, login, and…
Medium
CVE-2022-25774
Prior to the patched version, logged in users of Mautic are vulnerable to a self XSS vulnerability in the notifications within Mautic. Users could inject malicious code into the notification when sa…
2024-09-17
High
CVE-2021-27916
Prior to the patched version, logged in users of Mautic are vulnerable to Relative Path Traversal/Arbitrary File Deletion. Regardless of the level of access the Mautic user had, they could delete fil…
High
CVE-2021-27915
Prior to the patched version, there is an XSS vulnerability in the description fields within the Mautic application which could be exploited by a logged in user of Mautic with the appropriate permiss…
2024-04-10
Medium
CVE-2024-2730
Mautic uses predictable page indices for unpublished landing pages, their content can be accessed by unauthenticated users under public preview URLs which could expose sensitive data. At the time of…
2023-01-09
Medium
CVE-2022-4426
The Mautic Integration for WooCommerce WordPress plugin before 1.0.3 does not have proper CSRF check when updating settings, and does not ensure that the options to be updated belong to the plugin, a…
2022-06-20
Critical
CVE-2022-25772
A cross-site scripting (XSS) vulnerability in the web tracking component of Mautic before 4.3.0 allows remote attackers to inject executable javascript
2022-06-01
High
CVE-2021-27914
A cross-site scripting (XSS) vulnerability in the installer component of Mautic before 4.3.0 allows admins to inject executable javascript
2021-08-30
Low
CVE-2021-27913
The function mt_rand is used to generate session tokens, this function is cryptographically flawed due to its nature being one pseudorandomness, an attacker can take advantage of the cryptographicall…
High
CVE-2021-27912
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack when viewing Mautic assets by utilizing inline JS in the title and adding a broken image URL as a remote asset. This can o…
High
CVE-2021-27911
Mautic versions before 3.3.4/4.0.0 are vulnerable to an inline JS XSS attack through the contact's first or last name and triggered when viewing a contact's details page then clicking on the action d…
High
CVE-2021-27910
Insufficient sanitization / filtering allows for arbitrary JavaScript Injection in Mautic using the bounce management callback function. The values submitted in the "error" and "error_related_to" par…
Medium
CVE-2021-27909
For Mautic versions prior to 3.3.4/4.0.0, there is an XSS vulnerability on Mautic's password reset page where a vulnerable parameter, "bundle," in the URL could allow an attacker to execute Javascrip…
2021-03-23
Medium
CVE-2021-27908
In all versions prior to Mautic 3.3.2, secret parameters such as database credentials could be exposed publicly by an authorized admin user through leveraging Symfony parameter syntax in any of the f…
2021-02-09
Critical
CVE-2020-35125
A cross-site scripting (XSS) vulnerability in the forms component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript via mautic[return] (a different attack method than CVE…
2021-01-28
Critical
CVE-2020-35124
A cross-site scripting (XSS) vulnerability in the assets component of Mautic before 3.2.4 allows remote attackers to inject executable JavaScript through the Referer header of asset downloads.
2021-01-19
Critical
CVE-2020-35129
Mautic before 3.2.4 is affected by stored XSS. An attacker with access to Social Monitoring, an application feature, could attack other users, including administrators. For example, an attacker could…
Critical
CVE-2020-35128
Mautic before 3.2.4 is affected by stored XSS. An attacker with permission to manage companies, an application feature, could attack other users, including administrators. For example, by loading an…
2019-09-20
Medium
CVE-2018-11200
An issue was discovered in Mautic 2.13.1. It has Stored XSS via the company name field.
2019-09-06
Medium
CVE-2018-11198
An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json.
2018-04-18
Critical
CVE-2018-8092
Mautic before 2.13.0 allows CSV injection.
Medium
CVE-2018-8071
Mautic before v2.13.0 has stored XSS via a theme config file.
2018-04-17
High
CVE-2018-10189
An issue was discovered in Mautic 1.x and 2.x before 2.13.0. It is possible to systematically emulate tracking cookies per contact due to tracking the contact by their auto-incremented ID. Thus, a th…
2018-02-09
Medium
CVE-2017-1000506
Mautic version 2.11.0 and earlier contains a Cross Site Scripting (XSS) vulnerability in Company's name that can result in denial of service and execution of javascript code.
2018-01-03
Medium
CVE-2017-1000490
Mautic versions 1.0.0 - 2.11.0 are vulnerable to allowing any authorized Mautic user session (must be logged into Mautic) to use the Filemanager to download any file from the server that the web user…
High
CVE-2017-1000489
Mautic versions 2.0.0 - 2.11.0 with a SSO plugin installed could allow a disabled user to still login using email address
Medium
CVE-2017-1000488
Mautic version 2.1.0 - 2.11.0 is vulnerable to an inline JS XSS attack when using Mautic forms on a Mautic landing page using GET parameters to pre-populate the form.
2017-07-17
High
CVE-2017-1000046
Mautic 2.6.1 and earlier fails to set flags on session cookies
2017-05-10
High
CVE-2017-8874
Multiple cross-site request forgery (CSRF) vulnerabilities in Mautic 1.4.1 allow remote attackers to hijack the authentication of users for requests that (1) delete email campaigns or (2) delete cont…