CVE-2021-27917

XSS in contact tracking and page hits report

7.3 HighFix available

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: Low
Integrity: Low
Availability: Low

Exploit likelihood

0.29%Up 0.2 points since Sep 19, 2024

What each source reports

CVE List Score used 7.3

XSS in contact tracking and page hits report

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

Record: CVE-2021-27917
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

EUVDEUVD-2024-2895 7.3

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

Record: EUVD-2024-2895
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Updated: 2026-11-03

GitHub AdvisoriesGHSA-xpc5-rr39-v8v2 5.1

Mautic has an XSS in contact tracking and page hits report

Summary

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

Patches

Please update to 4.4.13 or 5.1.1 or later.

Workarounds

None

References

https://owasp.org/www-project-top-ten/2017/A7_2017-Cross-Site_Scripting_(XSS) https://owasp.org/www-project-web-security-testing-guide/latest/4-Web_Application_Security_Testing/07-Input_Validation_Testing/02-Testing_for_Stored_Cross_Site_Scripting

If you have any questions or comments about this advisory:

Email us at [email protected]

Record: GHSA-xpc5-rr39-v8v2
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

NVD 7.3

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

Record: CVE-2021-27917
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weakness: CWE-79
Updated: 2026-11-02

OSV 5.4

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

Record: CVE-2021-27917
CVSS 3.1: 5.4 MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Updated: 2026-11-02

OSVGHSA-xpc5-rr39-v8v2 5.1

Mautic has an XSS in contact tracking and page hits report

Summary

Prior to this patch, a stored XSS vulnerability existed in the contact tracking and page hits report.

Patches

Please update to 4.4.13 or 5.1.1 or later.

Workarounds

None

References

If you have any questions or comments about this advisory:

Email us at [email protected]

Record: GHSA-xpc5-rr39-v8v2
CVSS 4.0: 5.1 MediumCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
CVSS 3.1: 7.3 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness: CWE-79
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`mautic/core-lib` Packagist	1.0.0-beta4 up to 4.4.13	4.4.13
`mautic/core-lib` Packagist	5.0.0-alpha up to 5.1.1	5.1.1
`mautic/core` Packagist	1.0.0-beta4 up to 4.4.13	4.4.13
`mautic/core` Packagist	5.0.0-alpha up to 5.1.1	5.1.1
`mautic/core-lib` Packagist	1.0.0-beta4 up to 4.4.13, plus listed versions 4.0.04.0.0-alpha14.0.0-beta4.0.0-rc4.0.1 Show 27 moreShow less 4.0.24.1.04.1.14.1.24.2.04.2.0-rc4.2.0-rc14.2.14.2.24.3.04.3.0-beta4.3.0-rc4.3.14.4.04.4.14.4.1-alpha4.4.104.4.114.4.124.4.24.4.34.4.44.4.54.4.64.4.74.4.84.4.9	4.4.13
`mautic/core-lib` Packagist	5.0.0-alpha up to 5.1.1, plus listed versions 5.0.05.0.0-alpha15.0.0-beta15.0.0-beta25.0.0-rc1 Show 6 moreShow less 5.0.0-rc25.0.15.0.25.0.35.0.45.1.0	5.1.1
`mautic/core` Packagist	1.0.0-beta4 up to 4.4.13, plus listed versions 1.0.01.0.0-rc11.0.0-rc21.0.0-rc31.0.0-rc4 Show 45 moreShow less 1.0.11.0.21.0.31.0.41.0.51.1.01.1.11.1.21.1.31.2.01.2.0-beta11.2.11.2.21.2.31.2.41.3.01.3.11.4.01.4.12.0.02.0.12.1.02.1.12.10.02.10.0-beta2.10.12.11.02.11.0-beta2.12.02.12.0-beta2.12.12.12.1-beta2.12.22.12.2-beta2.13.02.13.0-beta2.13.12.14.02.14.0-beta2.14.12.14.1-beta2.14.22.14.2-beta2.15.02.15.0-beta	4.4.13
`mautic/core` Packagist	5.0.0-alpha up to 5.1.1, plus listed versions 5.0.05.0.0-alpha15.0.0-beta15.0.0-beta25.0.0-rc1 Show 6 moreShow less 5.0.0-rc25.0.15.0.25.0.35.0.45.1.0	5.1.1

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases, published	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-27917 is a high vulnerability (CVSS 7.3) in Acquia Mautic, published September 18, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.29%, the 21st percentile. Fixed in mautic/core-lib 4.4.13.

References

This page doesn't list everything

Left out here: 96 versions. The JSON record has them.