Bagisto, an open‑source Laravel eCommerce platform, contains a stored XSS flaw in the CMS page editor. The platform normally sanitizes <script> tags, but an attacker can bypass this check by manipulating the raw HTTP POST payload before it is processed. This allows the attacker to store malicious JavaScript that will be executed whenever the CMS page is viewed or edited, potentially leading to account hijacking and backend compromise. The vulnerability is rated CW‑79: Cross‑Site Scripting.

Vendors listed under bagisto:bagisto; any deployment of Bagisto earlier than version 2.3.10 is affected. Version 2.3.10 and later contain the fix and are not vulnerable.

The CVSS score of 5.2 indicates moderate severity, while the EPSS of less than 1% suggests a very low probability of observed exploitation. The vulnerability is not listed in the CISA KEV catalog. Inferred attack scenarios involve an attacker with CMS editing privileges submitting a crafted POST request, or an administrator inadvertently saving malicious content. Once stored, the payload will run in the browser context of any user viewing or editing the page.