What’s Vulnerable › Vulnerabilities

CVE-2025-60880

• Severity: high (CVSS 8.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-10 · updated 2026-06-17
• Weakness: CWE-79

Description

An authenticated stored XSS vulnerability exists in the Bagisto 2.3.6 admin panel's product creation path, allowing an attacker to upload a crafted SVG file containing malicious JavaScript code. This vulnerability can be exploited by an authenticated admin user to execute arbitrary JavaScript in the browser, potentially leading to session hijacking, data theft, or unauthorized actions.

Affected products

• Webkul Bagisto: 2.3.6

References

• https://gist.github.com/daman-preet-singh/cd431f4c30a585bb87d3c69e4a8eec98
• https://github.com/Shenal01/CVE-2025-60880

Get alerted when CVE-2025-60880 or the next vulnerability affects your stack