Executive brief
Mettle Sendportal, an open-source email marketing platform, contains a security flaw in how it handles campaign content. An attacker with basic user access can inject malicious scripts into email campaigns. When other users or recipients view the campaign's web version, these scripts execute automatically, potentially allowing the attacker to perform unauthorized actions or steal session information.
Technical details
A stored cross-site scripting (XSS) vulnerability exists in Mettle Sendportal up to 3.0.1. The root cause is the use of the unescaped Laravel Blade directive {!! $content !!} within the vendor/mettle/sendportal-core/resources/views/webview/show.blade.php file. An authenticated attacker can inject arbitrary JavaScript into the 'content' field during campaign creation. This script is then executed in the context of any user viewing the campaign preview or any recipient accessing the public webview link (/webview/{hash}). As of the advisory date, the project has been notified but a formal patch has not been released.
Affected products
- Mettle Sendportal up to 3.0.1
Timeline
- 2026-05-02: disclosed: Issue reported to the vendor via GitHub issue #338
- 2026-06-01: advisory: CVE published and added to NVD