# CVE-2026-10234: Mettle Sendportal stored XSS in Campaign webview

Source: https://junglewise.ai/threats/cve-2026-10234-mettle-sendportal-stored-xss-in-campaign-webview  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-06-01. Updated: 2026-06-01  
License: CC BY 4.0 with a link back

CVE-2026-10234 · Severity: low · CVSS 3.5 · Published 2026-06-01

Mettle Sendportal, an open-source email marketing platform, contains a security flaw in how it handles campaign content. An attacker with basic user access can inject malicious scripts into email campaigns. When other users or recipients view the campaign's web version, these scripts execute automatically, potentially allowing the attacker to perform unauthorized actions or steal session information.

Technologies: [Mettle Sendportal](https://junglewise.ai/threats/technologies/sendportal). Vendors: [Mettle](https://junglewise.ai/threats/vendors/mettle).

## Quick answers

**Is CVE-2026-10234 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10234 being exploited in the wild.

**How severe is CVE-2026-10234?** Low severity, with a CVSS score of 3.5, published 1 June 2026.

**Which products and versions are affected?** Mettle Sendportal up to 3.0.1.

**Is there a fix for CVE-2026-10234?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-10234 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-10234?** Check whether you run Mettle Sendportal at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A stored cross-site scripting (XSS) vulnerability exists in Mettle Sendportal up to 3.0.1. The root cause is the use of the unescaped Laravel Blade directive {!! $content !!} within the vendor/mettle/sendportal-core/resources/views/webview/show.blade.php file. An authenticated attacker can inject arbitrary JavaScript into the 'content' field during campaign creation. This script is then executed in the context of any user viewing the campaign preview or any recipient accessing the public webview link (/webview/{hash}). As of the advisory date, the project has been notified but a formal patch has not been released.

## Affected products

- Mettle Sendportal up to 3.0.1

## Timeline

- 2026-05-02: disclosed: Issue reported to the vendor via GitHub issue #338
- 2026-06-01: advisory: CVE published and added to NVD

## References

- [https://github.com/mettle/sendportal/](https://github.com/mettle/sendportal/)
- [https://github.com/mettle/sendportal/issues/338](https://github.com/mettle/sendportal/issues/338)
- [https://vuldb.com/cve/CVE-2026-10234](https://vuldb.com/cve/CVE-2026-10234)
- [https://vuldb.com/submit/822923](https://vuldb.com/submit/822923)
- [https://vuldb.com/submit/825494](https://vuldb.com/submit/825494)
- [https://vuldb.com/vuln/367513](https://vuldb.com/vuln/367513)
- [https://vuldb.com/vuln/367513/cti](https://vuldb.com/vuln/367513/cti)

## Related threats

- [Mettle SendPortal stored XSS in template management](https://junglewise.ai/threats/cve-2026-26483-mettle-sendportal-stored-xss-in-template-management)
- [Mettle SendPortal missing authentication in APIv1 Webhooks](https://junglewise.ai/threats/cve-2026-15192-mettle-sendportal-missing-authentication-in-apiv1-webhooks)
- [Mettle SendPortal authorization bypass in Campaign Creation Endpoint](https://junglewise.ai/threats/cve-2026-15191-mettle-sendportal-authorization-bypass-in-campaign-creation)