XSS vulnerability in theme config file in Mautic

MEDIUM 6.1CVE-2018-8071 · GHSA-5w74-jx7m-x6hv · Published 18/04/2018 · updated 17/06/2026

In short

CVE-2018-8071 is a MEDIUM (CVSS 6.1) vulnerability affecting mautic/core, mautic (mautic).
Chance of exploitation in the next 30 days (EPSS): 0.81%, higher than 56.9% of all vulnerabilities.
Fix: update to 2.13.0 or later.

Package	Affected versions	Patched versions
mautic/core Packagist	`< 2.13.0`	`2.13.0`
mautic mautic	`< 2.13.0`	`2.13.0`

Mautic before v2.13.0 has stored XSS via a theme config file.

Update to 2.13.0 or later.

None.

If you have any questions or comments about this advisory:

NVD description

Mautic before v2.13.0 has stored XSS via a theme config file.

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Package

Affected versions

Patched versions

Packagist

< 2.13.0

2.13.0

< 2.13.0

2.13.0

Description

Mautic before v2.13.0 has stored XSS via a theme config file.

Update to 2.13.0 or later.

None.

If you have any questions or comments about this advisory:

NVD description

Mautic before v2.13.0 has stored XSS via a theme config file.

More vulnerabilities in mautic/core

See all →