A stored Cross‑Site Scripting flaw resides in the Projects component of Mautic 7. Project names supplied by an authenticated user with create or edit rights are displayed without proper sanitization on administrative detail views. If a malicious script is injected, the code runs when an administrator hovers over a project tag. This can allow the attacker to perform administrative actions, modify system configuration, or exfiltrate data within the victim’s browser session.

The issue affects the Mautic 7 project management module. Any instance running Mautic 7 that allows users to create or edit projects is vulnerable until corrected.

The CVSS score of 7.6 indicates a medium‑to‑high severity. The EPSS score is not available and the vulnerability is not listed in the CISA KEV catalog, suggesting limited knowledge of active exploitation. The likely exploit requires an authenticated user with project creation/edit rights to inject script, and an administrator to view the project detail. Once triggered, the script executes with the administrator’s privileges, providing significant impact.