Stored Cross-Site Scripting Vulnerability in ReadyEcommerce by CodeCanyon
CVE-2026-63105

5.1MEDIUM

Key Information:

Vendor

Razinsoft

Status
Ready Ecommerce
Vendor
CVE Published:
10 August 2026

What is CVE-2026-63105?

ReadyEcommerce versions prior to 4.5.2 are susceptible to a stored cross-site scripting (XSS) vulnerability. This flaw allows authenticated customers to inject malicious HTML content into chat and support ticket messages. The vulnerability arises from unsanitized rendering in specific components, such as Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue. An attacker can leverage this vulnerability to submit specially crafted messages that execute arbitrary JavaScript in the browsers of shop owners or administrators viewing the messages, leading to potential session cookie theft and unauthorized account access.

Affected Version(s)

Ready eCommerce 0

References

https://codecanyon.net/item/ready-ecommerce-complete-mult...
productrelease-notes
https://www.vulncheck.com/advisories/readyecommerce-store...
third-party-advisory

CVSS V4

Score:
5.1
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Alfaz Hossain
.