CVE-2026-60120

Name of the Vulnerable Software and Affected Versions Bagisto versions prior to 2.4.4

Description An issue exists where unauthenticated attackers can execute arbitrary JavaScript in administrator browsers. This occurs through client-side template injection, a technique where an attacker injects template expressions that the client-side framework evaluates as code. By registering a customer account with a malicious payload in the first or last name field, the create.blade.php template renders these fields without the Vue.js v-pre directive. Consequently, Vue.js evaluates the stored expressions as live JavaScript when an administrator accesses the Create Order page for the affected customer.

Recommendations Update Bagisto to version 2.4.4 or later.