{"id":"CVE-2026-60120","title":"Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php","summary":"Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer accoun…","severity":"medium","cvss":5.4,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L","cvssSource":"cna","cwe":["CWE-79"],"vendor":"Webkul","product":"Bagisto","affected":["Bagisto < 2.4.4"],"ssvc":{"exploitation":"none","automatable":"no","technicalImpact":"partial","timestamp":"2026-07-10T14:46:55.055626Z"},"published":"2026-07-09","updated":"2026-11-08","sourceUpdated":"2026-11-08T14:07:32.665Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-60120","references":[{"url":"https://github.com/bagisto/bagisto/releases/tag/v2.4.4","label":"Bagisto 2.4.4 Release Notes"},{"url":"https://github.com/bagisto/bagisto/commit/49d0c3fc90dedf8782c45c5979df4f4595d6bb97","label":"Patch Commit"},{"url":"https://www.vulncheck.com/advisories/bagisto-stored-xss-via-csti-in-create-blade-php"}],"tags":["cve.org"],"epss":0.00355,"epssPercentile":0.2949,"ingestedAt":"2026-11-08T14:51:22.274Z","slug":"CVE-2026-60120","body":"## Overview\n\nBagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. The create.blade.php template renders customer name fields without the Vue.js v-pre directive, causing Vue.js to evaluate stored template expressions as live JavaScript when an administrator opens the Create Order page for the affected customer.\n\n## Affected\n\n- `Bagisto < 2.4.4`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"sunlit","depthScore":30,"depthScoreParts":{"impact":29.7,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}