Executive brief
ReadyEcommerce is an e-commerce platform that enables merchants to manage customer communications through chat and support ticket systems. A vulnerability in versions before 4.5.2 allows authenticated customers to inject malicious code into these messaging systems that executes in the browsers of shop administrators and owners, potentially enabling attackers to steal session credentials and take over administrator accounts.
Technical details
ReadyEcommerce before version 4.5.2 contains a stored cross-site scripting (XSS) vulnerability in its messaging components (Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue). The vulnerability stems from improper use of Vue's v-html directive, which renders user-supplied HTML without sanitization. An authenticated customer can inject malicious HTML and JavaScript payloads through chat or support ticket messages; when an administrator or shop owner views the message, the injected script executes in their browser context. This enables attackers to steal session cookies and perform account takeover. The vulnerability requires authentication to exploit but only user-level (customer) authentication, and user interaction (viewing the malicious message) is required on the victim side. A patch is available in version 4.5.2 and later.
Affected products
- Ready ReadyEcommerce before 4.5.2
Timeline
- 2026-08-10: disclosed