CVE-2025-9823Reflected XSS in lead:addLeadTags - Quick Add

Description

SummaryA Cross-Site Scripting (XSS) vulnerability allows an attacker to execute arbitrary JavaScript in the context of another user’s session. This occurs because user-supplied input is reflected back in the server’s response without proper sanitization or escaping, potentially enabling malicious actions such as session hijacking, credential theft, or unauthorized actions in the application. DetailsThe vulnerability resides in the “Tags” input field on the /s/ajax?action=lead:addLeadTags endpoint. Although the server applies sanitization before storing the data or returning it later, the payload is executed immediately in the victim’s browser upon reflection, allowing an attacker to run arbitrary JavaScript in the user’s session. ImpactA Reflected XSS attack can have a significant impact, allowing attackers to steal sensitive user data like cookies, redirect users to malicious websites, manipulate the web page content, and essentially take control of a user's session within an application by executing malicious JavaScript code within the victim's browser, even if the server-side code is secure; essentially enabling them to perform actions as if they were the logged-in user. References * Web Security Academy: Cross-site scripting https://portswigger.net/web-security/cross-site-scripting * Web Security Academy: Reflected cross-site scripting https://portswigger.net/web-security/cross-site-scripting/reflected

Timeline

Scores

EPSS (exploitation in 30 days)

0.32% · top 75% of all CVEs (14 Nov 2026)

CISA SSVC

Exploitation: none · Automatable: no · Technical impact: partial

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 4.8.

Affected products

• Mautic · Mautic

  • affected >= 4.4.0 – < < 4.4.17
  • affected >= 5.0.0-alpha – < < 5.2.8
  • affected >= 6.0.0-alpha – < < 6.0.5

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Packagistmautic/coreGHSA-9v8p-m85m-f7mm (opens in a new tab)

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• EUVD EUVD-2025-26573 (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-9v8p-m85m-f7mm (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2025-9823](https://cveledger.app/badge/CVE-2025-9823.svg)](https://cveledger.app/cve/CVE-2025-9823)

Record last updated 3 Sept 2025, 17:33 UTC.