Description
An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.
Affected products
webkul: bagisto
References2
- gist.github.com/daman-preet-singh/cd431f4c30a585bb87d3c69e4a8ee… ExploitThird Party Advisory
- github.com/Shenal01/CVE-2025-60880 ExploitThird Party Advisory
Metrics
- CVSS 3.1
-
8.3
HIGH
Score source: NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H - EPSS — exploit probability
- 0% percentile: 36 · as of 9 November 2026
- CWE
- CWE-79
Could this be exploited in your environment?
A patch closes the known hole. A penetration test shows what an attacker can still reach — with proof.