XSS vulnerability in Author URL of themes in Mautic

MEDIUM 6.1CVE-2018-11198 · GHSA-xcf7-cj8q-pcjm · Published 06/09/2019 · updated 17/06/2026

In short

CVE-2018-11198 is a MEDIUM (CVSS 6.1) vulnerability affecting mautic/core, mautic (acquia).
Chance of exploitation in the next 30 days (EPSS): 0.91%, higher than 59.8% of all vulnerabilities.
Fix: update to 2.14.0 or later.

Package	Affected versions	Patched versions
mautic/core Packagist	`≥ 2.13.1, < 2.14.0`	`2.14.0`
mautic acquia	`= 2.13.1`	No fix yet

Description

Impact

An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes.

Patches

Update to 2.14 or later

Workarounds

None

References

https://github.com/mautic/mautic/releases/tag/2.14.0

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

NVD description

An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json.

References

mautic/mautic security advisory · WEB
nvd.nist.gov/vuln/detail/CVE-2018-11198 · ADVISORY
mautic/mautic release · WEB
mautic/mautic release 2.14.0 · WEB

More vulnerabilities in mautic/core

See all →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

mautic/core

Packagist

≥ 2.13.1, < 2.14.0

2.14.0

mautic

acquia

= 2.13.1

No fix yet

Description

Impact

An XSS vulnerability was discovered in Mautic 2.13.1 in the Author URL of themes.

Patches

Update to 2.14 or later

Workarounds

None

References

https://github.com/mautic/mautic/releases/tag/2.14.0

For more information

If you have any questions or comments about this advisory:

Email us at [email protected]

NVD description

An issue was discovered in Mautic 2.13.1. There is Stored XSS via the authorUrl field in config.json.

More vulnerabilities in mautic/core

See all →