CVE-2026-63105— ReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket Systems
Possible ATT&CK Techniques 3AI
T1005 · Data from Local System T1078 · Valid Accounts T1189 · Drive-by CompromiseGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-63105
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket Systems
Source: CVE Program / CVE List V5
Vulnerability Description
ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue. Attackers can submit crafted message content that executes arbitrary JavaScript in the browser of any shop owner or administrator who views the message, enabling session cookie theft and account takeover.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Razinsoft | Ready eCommerce | 0 ~ 4.5.2 | - |
II. Public POCs for CVE-2026-63105
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-63105
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-63105 (1)
IV. Related Vulnerabilities
Same weakness: CWE-79
- CVE-2026-72730
Discourse: Stored XSS chat-transcript username unescaped in - CVE-2026-72729
Discourse: Stored XSS in discourse-local-dates plugin - CVE-2026-56619
HCL BigFix Mobile is vulnerable to Reflected Cross-Site Scri - CVE-2026-72727
Discourse: Stored XSS in the moderation review queue - CVE-2026-72725
Discourse: Stored XSS in staff action logs injects staff UI
V. Comments for CVE-2026-63105
No comments yet