Is CVE-2026-60120 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-60120 being exploited in the wild.

How severe is CVE-2026-60120?

Medium severity, with a CVSS score of 5.4, published 9 July 2026.

Is there a fix for CVE-2026-60120?

A patch was published on 2026-05-05: Version 2.4.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-60120 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-60120?

Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-60120: Bagisto stored XSS via client-side template injection in create.blade.php

CVE-2026-60120 · Severity: medium · CVSS 5.4 · Published 2026-07-09

Bagisto, an open-source e-commerce platform, is vulnerable to a security flaw that allows attackers to run malicious scripts in an administrator's browser. By simply registering a new customer account with a specially crafted name, an attacker can trigger this script when an administrator views the 'Create Order' page. This could lead to unauthorized actions being performed on behalf of the administrator or the theft of sensitive session information.

Quick answers

Is CVE-2026-60120 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-60120 being exploited in the wild.
How severe is CVE-2026-60120?: Medium severity, with a CVSS score of 5.4, published 9 July 2026.
Which products and versions are affected?: Bagisto Bagisto < 2.4.4.
Is there a fix for CVE-2026-60120?: A patch was published on 2026-05-05: Version 2.4.4 released Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-60120 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-60120?: Check whether anything you run is named in the advisory. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A stored cross-site scripting (XSS) vulnerability exists in Bagisto versions prior to 2.4.4 due to client-side template injection (CSTI). The root cause is located in the 'create.blade.php' template, which fails to use the Vue.js 'v-pre' directive when rendering customer name fields. This oversight allows Vue.js to interpret and execute template expressions stored in the database (such as those provided during customer registration) as live JavaScript. An attacker can exploit this by registering a customer account with a malicious payload in the first or last name fields; the script executes when an authenticated administrator navigates to the 'Create Order' page for that customer. The issue is resolved in version 2.4.4.

Affected products

Bagisto Bagisto < 2.4.4

Timeline

2026-05-05: patched: Version 2.4.4 released
2026-07-09: disclosed: CVE-2026-60120 published

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.