CVE-2026-60120CWE-79

Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php

Medium · published July 9, 2026

CVSS v4.0
5.1
EPSS
0%
Percentile
28.1
In the wild
Unconfirmed
What it is

Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. The create.blade.php template renders customer name fields without the Vue.js v-pre directive, causing Vue.js to evaluate stored template expressions as live JavaScript when an administrator opens the Create Order page for the affected customer.

The record
Technical detail
CVSS v4.0
5.1 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
EPSS
0.00355 · 28.1th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2026-07-09T20:43Z
EPSS history
Timeline
  • 09 JUL 20:43Z
    Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php
    cvelistv5