CVE-2026-10234

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in Mettle SendPortal up to version 3.0.1. The issue resides in the file /vendor/mettle/sendportal-core/resources/views/webview/show.blade.php, where user-supplied content in the campaign editor is rendered using Laravel Blade's {!! !!} directive without sanitization. This allows an authenticated user to inject arbitrary JavaScript into the content field, which is executed when the campaign preview or the public webview link is accessed [1].

Exploitation

An attacker must first authenticate as a valid user. They then create a campaign and, in the Content field, insert a malicious payload such as `. Upon saving, the script is stored. When the attacker or another user opens the campaign preview page, or when the public webview link (/webview/{hash}`) is accessed (even in incognito mode), the JavaScript executes without further authentication [1].

Impact

Successful exploitation results in stored XSS that can affect multiple users. Because the script runs in the application's origin, an attacker could potentially hijack user sessions, perform unauthorized actions on behalf of victims, or conduct phishing and credential harvesting attacks [1].

Mitigation

As of the publication date, the vendor has not responded to the issue and no official patch has been released. The recommended fix is to sanitize user input using a library like Mews\Purifier\Facades\Purifier before storing, and to avoid using raw Blade directives ({!! !!}) unless content is properly escaped [1].