Cross-Site Scripting Vulnerability in Mautic by Mautic

CVE-2025-9823

What is CVE-2025-9823?

The Cross-Site Scripting vulnerability affects the 'Tags' input field on the /s/ajax?action=lead:addLeadTags endpoint of Mautic. In this flaw, user-generated input is reflected in the server's response without adequate sanitization, allowing attackers to run arbitrary JavaScript in the context of an authenticated user's session. This omission presents severe risks, including session hijacking and credential theft, as the executed JavaScript can manipulate web page content and redirect users to malicious sites. Despite server-side data sanitization, the immediate execution of payloads in the user's browser poses a significant threat to the application's security.

References