CVE-2026-60120: Bagisto Stored XSS via Customer Name Template Injection

Technical summary

CVE-2026-60120 is a stored XSS vulnerability stemming from improper template rendering in Bagisto's order creation interface. The vulnerability exists in the create.blade.php template, which renders customer name fields without the Vue.js v-pre directive. Because v-pre is omitted, Vue.js treats the stored customer name as a template expression and evaluates it as live JavaScript when an administrator accesses the Create Order page. The attack chain requires only account registration (unauthenticated) and user interaction (administrator visiting the affected page), making the barrier to exploitation low. The vulnerability affects Bagisto versions prior to 2.4.4.

Business impact

Exploitation of this vulnerability could allow attackers to compromise administrator sessions, exfiltrate sensitive customer or order data, modify orders or customer records, or establish persistent backdoors within the Bagisto admin interface. For e-commerce operators, this represents a risk to business continuity, customer trust, and potential compliance violations if customer data is accessed or altered. The attack requires administrator interaction but no special privileges from the attacker, making it a practical concern for any Bagisto deployment with multiple administrator accounts.

Affected systems

Bagisto versions before 2.4.4 are affected. The vulnerability exists in the customer account creation workflow and the order creation interface. Any Bagisto installation that allows customer self-registration and has administrators who access the Create Order page is vulnerable. Versions 2.4.4 and later are expected to include mitigations; verify against the official vendor advisory for complete version information and patch availability across different release branches.

Exploitability

This vulnerability is relatively straightforward to exploit. An attacker needs only to register a free customer account (unauthenticated) and inject a malicious payload into the first or last name field. The payload is stored server-side and triggers automatically when any administrator opens the Create Order page for that customer. No special network positioning, credential compromise, or complex interaction is required beyond social engineering or natural administrative workflow. The CVSS score of 5.4 (MEDIUM) reflects the requirement for administrator interaction (UI:R) and the ability to cause integrity and availability impact (I:L/A:L) rather than confidentiality breach.

Remediation

Upgrade Bagisto to version 2.4.4 or later. This version is expected to include the v-pre directive in the create.blade.php template to prevent Vue.js from evaluating stored name fields as template expressions. For deployments unable to upgrade immediately, implement a temporary input validation policy that sanitizes or rejects customer names containing template syntax (e.g., double curly braces, Vue directives), though this is not a complete substitute for the official patch. Additionally, restrict access to the Create Order page to a minimal set of trusted administrators.

Patch guidance

Apply the official Bagisto security update to version 2.4.4 or later as soon as possible. Consult the official Bagisto release notes and security advisory for verification of patch contents and compatibility with your specific deployment. Test the patch in a non-production environment first, particularly if you have custom templates or Vue.js extensions that may interact with the updated create.blade.php file. After patching, verify that the v-pre directive is present in your create.blade.php template to confirm the fix has been applied.

Detection guidance

Monitor for suspicious customer account registrations containing template injection payloads in name fields—look for strings such as {{ }}, [[ ]], or Vue.js directives (v-if, v-show, v-bind) in customer first or last names. Review administrator activity logs for access to the Create Order page, and correlate with any subsequent suspicious browser activity or admin actions. On the server side, check your Bagisto database for customer records with names containing template syntax. Additionally, monitor browser console errors or JavaScript execution anomalies in administrator sessions accessing the Create Order page with affected customer records.

Why prioritize this

While the CVSS score is MEDIUM (5.4), this vulnerability warrants prioritized attention because it enables unauthorized administrator impersonation and data manipulation in e-commerce systems. The attack surface is broad (any customer registration), the barrier to exploitation is low (no authentication required for the attacker), and the impact targets high-value administrative functions. For organizations operating Bagisto in multi-tenant or high-transaction environments, this poses a direct risk to revenue, compliance, and customer trust. Early patching prevents potential supply chain or data theft scenarios.

Risk score, explained

The CVSS 3.1 score of 5.4 reflects a network-exploitable vulnerability (AV:N) with low attack complexity (AC:L) that can be triggered by an unauthenticated attacker (PR:L refers to the attacker's minimal privilege—account registration). However, the score accounts for the requirement that an administrator must interact with the malicious content (UI:R). The impact is limited to integrity and availability (I:L/A:L) rather than confidentiality; attackers cannot read data directly but can manipulate it. The scope is changed (S:C), meaning the vulnerability can affect resources beyond the vulnerable component. In practical terms, the score may understate risk for high-value Bagisto deployments where administrator compromise is highly damaging.

Frequently asked questions