An attacker can manipulate the content argument for the /webview/ component of the Campaign Handler in Mettle Sendportal, resulting in reflected cross‑site scripting. Because the flaw is present in versions up to 3.0.1, an attacker can supply arbitrary script code from a remote source. Successful exploitation could allow the execution of client‑side code in the victim's browser, enabling credential theft, session hijacking, or malicious page modification. The description explicitly states a remote attack is possible and the exploit is publicly available.

Mettle Sendportal versions up to and including 3.0.1 are affected. No specific sub‑components are listed beyond the /webview/ path of the Campaign Handler.

The CVSS score of 5.1 indicates moderate severity. EPSS data is unavailable and the vulnerability is not yet in the CISA KEV catalog, so the expected exploitation frequency is uncertain. However, because the attack vector is remote and the exploit is publicly available, organizations running affected versions should treat the risk as potentially meaningful. The lack of a patch in the vendor’s public channel implies the mitigation will rely on functional workarounds until an official fix is released.