---
id: CVE-2026-60120
title: Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php
summary: >-
  Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via
  client-side template injection that allows unauthenticated attackers to
  execute arbitrary JavaScript in administrator browsers by registering a
  customer accoun…
severity: medium
cvss: 5.4
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:L'
cvssSource: cna
cwe:
  - CWE-79
vendor: Webkul
product: Bagisto
affected:
  - Bagisto < 2.4.4
ssvc:
  exploitation: none
  automatable: 'no'
  technicalImpact: partial
  timestamp: '2026-07-10T14:46:55.055626Z'
published: '2026-07-09'
updated: '2026-11-08'
sourceUpdated: '2026-11-08T14:07:32.665Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-60120'
references:
  - url: 'https://github.com/bagisto/bagisto/releases/tag/v2.4.4'
    label: Bagisto 2.4.4 Release Notes
  - url: >-
      https://github.com/bagisto/bagisto/commit/49d0c3fc90dedf8782c45c5979df4f4595d6bb97
    label: Patch Commit
  - url: >-
      https://www.vulncheck.com/advisories/bagisto-stored-xss-via-csti-in-create-blade-php
tags:
  - cve.org
epss: 0.00355
epssPercentile: 0.2949
ingestedAt: '2026-11-08T14:51:22.274Z'
---

## Overview

Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. The create.blade.php template renders customer name fields without the Vue.js v-pre directive, causing Vue.js to evaluate stored template expressions as live JavaScript when an administrator opens the Create Order page for the affected customer.

## Affected

- `Bagisto < 2.4.4`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.