Description

ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue. Attackers can submit crafted message content that executes arbitrary JavaScript in the browser of any shop owner or administrator who views the message, enabling session cookie theft and account takeover.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-08-10T14:17:25.477Z",
  "pubdate": "2026-08-10T14:17:25.477Z",
  "executiveSummary": "ReadyEcommerce before version 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that exposes the application to severe client-side security risks.\nThe vulnerability exists within the messaging and support ticket systems, allowing authenticated customers to inject arbitrary and malicious HTML payloads.\nWhen a shop owner or administrator views the crafted messages, the injected scripts execute within the context of their administrative browser session.\nThis attacker capability facilitates high-impact security consequences, specifically session cookie theft and full administrative account takeover.\nExploitation requires authenticated access as a customer to submit malicious message content combined with administrative interaction to view the payload.\nThe affected systems comprise specific frontend component files handling message rendering, which process input without proper sanitization.\nThe risk implications are critical as successful exploitation compromises the confidentiality, integrity, and availability of administrative accounts and underlying e-commerce data.",
  "technicalDetails": "The vulnerability is a stored cross-site scripting (XSS) flaw stemming from the improper neutralization of user-supplied data before rendering it in the user interface.\nThe root cause is the utilization of the unsafe v-html directive within several frontend Vue components, which forces the raw interpretation and execution of HTML and JavaScript strings.\nThe vulnerable components identified are Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue.\nThe affected product is ReadyEcommerce in versions prior to 4.5.2.\nAuthentication requirements dictate that the attacker must possess an authenticated customer account to interact with the chat and support ticket messaging systems.\nPrivilege requirements for the payload execution side involve administrative or shop owner privileges, as they are the targets who must review the messages.\nNetwork exposure is inherent to standard web application protocols utilized by the e-commerce platform.\nThe attack flow proceeds as follows: First, an authenticated customer crafts a malicious payload containing arbitrary JavaScript enclosed within HTML tags. Second, the attacker submits this payload through the chat or support ticket messaging interfaces. Third, the backend persists the unsanitized payload into the database. Fourth, a shop owner or administrator accesses the messaging or support ticket interface to review customer inquiries. Fifth, the vulnerable components Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, or SupportTicketDetails.vue retrieve the stored payload and render it directly to the DOM using the v-html directive without prior sanitization or encoding.\nThe payload behavior involves executing arbitrary JavaScript in the victim administrator's browser session upon rendering.\nThe post-exploitation impact includes session cookie theft, session hijacking, unauthorized administrative actions, and complete account takeover of the shop owner or administrator."
}