CVE-2026-63105
Received Received - Intake

Stored XSS in ReadyEcommerce Before 4.5.2

Publication date: 2026-08-10

Last updated on: 2026-08-10

Assigner: VulnCheck

Description
ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue. Attackers can submit crafted message content that executes arbitrary JavaScript in the browser of any shop owner or administrator who views the message, enabling session cookie theft and account takeover.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-10
Last Modified
2026-08-10
Generated
2026-08-10
AI Q&A
2026-08-10
EPSS Evaluated
N/A
NVD
CVE-2026-63105
EUVD
EUVD-2026-55628

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
readyecommerce readyecommerce to 4.5.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

ReadyEcommerce before version 4.5.2 has a stored cross-site scripting (XSS) flaw. Authenticated customers can inject malicious HTML through chat and support ticket systems. The vulnerability occurs because user input is rendered unsanitized using the v-html directive in specific Vue.js components. This allows attackers to submit crafted messages that execute arbitrary JavaScript when viewed by shop owners or administrators.

Detection Guidance

To detect this vulnerability, inspect the ReadyEcommerce application version. Check if it is below 4.5.2. Review chat and support ticket messages for unsanitized HTML content or JavaScript payloads. Look for v-html directive usage in Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue files.

Impact Analysis

If you are a shop owner or administrator, viewing a malicious message could lead to session cookie theft or account takeover. Attackers could gain unauthorized access to your admin panel, steal sensitive data, or perform actions on your behalf. Even as a customer, if you interact with compromised admin interfaces, you might be exposed to further attacks.

Compliance Impact

This vulnerability could lead to unauthorized access to personal data, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information if customer data is compromised. Both standards mandate protecting user data, and this flaw could result in non-compliance, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade ReadyEcommerce to version 4.5.2 or later immediately. Implement input validation and output encoding for all user-generated content. Sanitize HTML content before rendering to prevent XSS attacks. Restrict authenticated customer permissions to reduce attack surface.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-63105. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart