Stored Cross-Site Scripting Vulnerability in Bagisto eCommerce Platform
CVE-2026-21451

5.2MEDIUM

Key Information:

Vendor

Bagisto

Status
Bagisto
Vendor
CVE Published:
2 January 2026

What is CVE-2026-21451?

A stored Cross-Site Scripting vulnerability exists in the Bagisto eCommerce platform, specifically affecting the CMS page editor in versions prior to 2.3.10. This issue allows attackers to bypass the platform's sanitization attempts on <script> tags by manipulating raw HTTP POST requests before submission. Consequently, arbitrary JavaScript may be injected and stored in CMS content, leading to execution whenever the affected page is viewed or edited. This poses significant security risks, including the potential for complete account takeover and backend hijacking, thereby endangering site administrators and users alike.

Affected Version(s)

bagisto < 2.3.10

References

https://github.com/bagisto/bagisto/security/advisories/GH...
x_refsource_CONFIRM

CVSS V4

Score:
5.2
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.