A stored Cross‑Site Scripting (XSS) flaw exists in the contact detail view of Mautic version 7. When a user can write to a custom contact field defined as HTML, the value is rendered without sanitization. An attacker can inject arbitrary JavaScript into such a field through contact editing, the API, or a mapped form submission. When another user, including an administrator, opens the contact’s detail page, the injected script runs in the victim’s browser context and can carry out administrative tasks on behalf of that user, such as creating new administrator accounts, altering system configuration, or accessing sensitive campaign data.

The vulnerability is specific to the Mautic web application, targeting version 7. No other products or derivatives are mentioned in the advisory. Users running this version or older releases that have not applied the fix are affected.

The CVSS score of 8.2 indicates high severity. No EPSS score is provided and the issue is not catalogued in the CISA KEV list. Exploitation requires the attacker to insert a payload into an HTML‑type custom field and a second authenticated user or administrator to view the contact detail page. This scenario makes the attack opportunistic but possible during normal administrative usage. Once the script executes, it operates with the full privileges of the logged‑in user, posing a significant risk of privilege escalation and data compromise.