CVE-2026-63105: ReadyEcommerce < 4.5.2 Stored XSS via Chat and Support Ticket Systems
ReadyEcommerce before 4.5.2 contains a stored cross-site scripting (XSS) vulnerability that allows authenticated customers to inject malicious HTML payloads through the chat and support ticket messaging systems by exploiting unsanitized rendering via the v-html directive in Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue. Attackers can submit crafted message content that executes arbitrary JavaScript in the browser of any shop owner or administrator who views the message, enabling session cookie theft and account takeover.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ReadyEcommerceto a version that resolves this vulnerability.Fixed in 4.5.2 - Compensating control
Mitigate exposure by restricting which users (e.g., only authenticated customers/authorized roles) can view chat and support ticket message content until the ReadyEcommerce < 4.5.2 stored XSS issue is remediated.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-63105?
The severity of CVE-2026-63105 is rated medium with a score of 5.4.
How do I fix CVE-2026-63105?
To fix CVE-2026-63105, update ReadyEcommerce to version 4.5.2 or later.
What type of vulnerability is CVE-2026-63105?
CVE-2026-63105 is a stored cross-site scripting (XSS) vulnerability.
Who is affected by CVE-2026-63105?
Authenticated customers using ReadyEcommerce versions below 4.5.2 are affected by CVE-2026-63105.
What can attackers achieve with CVE-2026-63105?
Attackers can inject malicious HTML payloads through chat and support ticket messaging systems due to CVE-2026-63105.