CVE-2026-60120 Details
Description
Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. The create.blade.php template renders customer name fields without the Vue.js v-pre directive, causing Vue.js to evaluate stored template expressions as live JavaScript when an administrator opens the Create Order page for the affected customer.
A stored cross-site scripting vulnerability has been identified in Bagisto versions prior to 2.4.4. This issue arises from client-side template injection, allowing unauthenticated attackers to execute arbitrary JavaScript in the browsers of administrators. The vulnerability is exploited by registering a customer account with a malicious payload in the first or last name field. The 'create.blade.php' template processes customer name fields without the Vue.js 'v-pre' directive, which leads to Vue.js evaluating the injected template expressions as live JavaScript. This exploitation occurs when an administrator accesses the 'Create Order' page for the affected customer.
Users can upgrade to Bagisto version 2.4.4 or later to address this vulnerability.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 10, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/bagisto/bagisto/commit/49d0c3fc90dedf8782c45c5979df4f4595d6bb97 | [email protected] | Source CodeVendor |
| https://github.com/bagisto/bagisto/releases/tag/v2.4.4 | [email protected] | Release NotesVendor |
| https://www.vulncheck.com/advisories/bagisto-stored-xss-via-csti-in-create-blade-php | [email protected] | AdvisoryRemedy |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-79 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Bagisto | < 2.4.4 (semver) |
CPE
Remediation
| |
Change History
4 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 14, 2026 | CVE Modified | [email protected] |
| Jul 10, 2026 | CVE Modified | CISA-ADP |
| Jul 10, 2026 | CVE Modified | [email protected] |
| Jul 9, 2026 | New CVE Received | [email protected] |