Security Advisory
CVE-2026-26483
6.1
MEDIUM
Vulnerability Description
Mettle SendPortal 3.0.1 and earlier contains a stored cross-site scripting (XSS) vulnerability in the template management functionality. The application fails to properly sanitize user-supplied input in the content parameter of the /templates endpoint, allowing an attacker to persistently inject malicious JavaScript code that is executed in the browsers of users who access the affected template.
Published Date
July 20, 2026
Official Source
NIST NVD Advisory