CVE-2026-60120 – Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php

CVE ID :CVE-2026-60120

Published : July 9, 2026, 9:16 p.m. | 32 minutes ago

Description :Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. The create.blade.php template renders customer name fields without the Vue.js v-pre directive, causing Vue.js to evaluate stored template expressions as live JavaScript when an administrator opens the Create Order page for the affected customer.

Severity: 5.4 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…