In MantisBT 2.28.0, the tag deletion interface displays the tag name in a confirmation message without proper escaping, allowing an attacker to embed malicious HTML or JavaScript into the page. If the site’s Content‑Security‑Policy permits script execution, the injected code runs in the browser context of any user who views the confirmation, enabling theft of session data, credential compromise, or further web‑based attacks.

All installations of Mantis Bug Tracker version 2.28.0 are vulnerable; the issue is fixed in 2.28.1. The vulnerability impacts any system running that exact version, regardless of other configuration, and can be observed across the common platform enumeration cpe:2.3:a:mantisbt:mantisbt:2.28.0.

The CVSS score of 8.6 indicates high severity, while the EPSS score of less than 1% suggests a low current exploitation probability. This entry is not listed in the KEV catalog. Attacks require an authenticated user with permission to delete tags; the exploitation occurs during normal use of the web interface, making the vulnerability accessible to anyone who can modify or create tags with malicious content.