CVE-2026-21451
Description
Bagisto is an open source laravel eCommerce platform. A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto prior to version 2.3.10 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be stored in the CMS content and executed whenever the page is viewed or edited. This exposes administrators to a high-severity risk, including complete account takeover, backend hijacking, and malicious script execution. Version 2.3.10 fixes the issue.
How to fix
- webkul bagisto2.3.10 or later
- bagisto/bagisto2.3.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| webkul bagisto | v < 2.3.10 | 2.3.10 |
| bagisto/bagistoPackagist | v < 2.3.10 | 2.3.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.