CVE-2025-60880

8.3 highEPSS 0.4%

High (8.3) in webkul bagisto. EPSS 0.4% chance of exploitation in the next 30 days.

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

Severity

CVSS 3.1

8.3 high

CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:L/A:H

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 35% of CVEs (scores of 2026-10-31)
CWE: CWE-79
Published: 2025-10-10
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

webkul:bagisto

References

https://gist.github.com/daman-preet-singh/cd431f4c30a585bb87d3c69e4a8eec98
https://github.com/Shenal01/CVE-2025-60880

Check your stack JSON