A stored Cross‑Site Scripting flaw exists in Mautic 7’s project selector component. When the application renders project selection menus via AJAX, it injects project names directly into the DOM without sanitization. An authenticated user who can create projects may store a malicious script payload in a project’s name. When another administrative user opens an entity editor containing the project selector, the embedded script runs in the context of that user’s browser session, potentially leading to session hijacking, unauthorized operations, or data exposure.

The vulnerability affects Mautic 7 installations, specifically the project selector used when associating projects with system entities. No specific patch or version is listed yet; any Mautic 7 instance that allows project creation by users is potentially impacted.

The CVSS score of 5.4 classifies the issue as medium severity. No EPSS score is available and the vulnerability is not listed in the CISA KEV catalog. The attacker must be authenticated with project‑creation rights and must convince or wait for another administrative user to load the affected editor. Once the script executes, it can hijack the session or trigger additional unauthorized actions within the user’s active context.