CVE-2026-21451
Medium · 6.5Bagisto has HTML Filter Bypass that Enables Stored XSS
CVSS
6.5
EPSS
0.6%
Published
Jan 2, 2026
CISA due date
—
The record
A stored Cross-Site Scripting (XSS) vulnerability exists in Bagisto 2.3.8 within the CMS page editor. Although the platform normally attempts to sanitize `<script>` tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be stored in the CMS content and executed whenever the page is viewed or edited. This exposes administrators to a high-severity risk, including complete account takeover, backend hijacking, and malicious script execution.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Packagist | bagisto/bagisto | 0 | 2.3.10 |
Related vulnerabilities
- GHSA-2mwc-h2mg-v6p8 Bagisto has HTML Filter Bypass that Enables Stored XSS Same vulnerability
- GHSA-mqhg-v22x-pqj8 Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege… Also affects bagisto/bagisto
- GHSA-x5rw-qvvp-5cgm Bagisto has IDOR in Customer Order Reorder Functionality Also affects bagisto/bagisto
- GHSA-5j4h-4f72-qpm6 Bagisto has Normal & Blind SSTI from low-privilege user when ordering product Also affects bagisto/bagisto
- GHSA-9hvg-qw5q-wqwp Bagisto SSTI vulnerability in type parameter can lead to RCE Also affects bagisto/bagisto
- GHSA-6h7w-v2xr-mqvw Bagisto Missing Authentication on Installer API Endpoints Also affects bagisto/bagisto
- CVE-2026-21449 Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege… Also affects bagisto/bagisto
- CVE-2026-21446 Bagisto Missing Authentication on Installer API Endpoints Also affects bagisto/bagisto