CVE-2026-60120

Medium

Description

Bagisto before 2.4.4 contains a stored cross-site scripting vulnerability via client-side template injection that allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers by registering a customer account with malicious payload in the first or last name field. The create.blade.php template renders customer name fields without the Vue.js v-pre directive, causing Vue.js to evaluate stored template expressions as live JavaScript when an administrator opens the Create Order page for the affected customer.

SeverityMedium

CVSS5.4

Exploit probability—

Product

Bagisto

PublishedJul 9, 2026

First seenJul 9, 2026

Weakness typeCWE-79Cross-site scripting (XSS)

How to fix

Update

Webkul Bagisto2.4.4 or later

Patches

github.com/bagisto/bagisto/commit/49d0c3fc90dedf8782c45c5979df4f4595d6bb97

Vendor advisories

github.com/bagisto/bagisto/releases/tag/v2.4.4

Affected products

Product	Affected versions	Fixed in
Webkul Bagisto	v < 2.4.4	2.4.4

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.