CVE-2026-63105: ReadyEcommerce Stored XSS Vulnerability

CVE-2026-63105 Overview

CVE-2026-63105 is a stored cross-site scripting (XSS) vulnerability in ReadyEcommerce versions before 4.5.2. The flaw exists in the chat and support ticket messaging systems, where user-supplied content is rendered through the Vue.js v-html directive without sanitization. Authenticated customers can inject malicious HTML payloads through message content processed by Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue. When shop owners or administrators view these messages, the injected JavaScript executes in their browser context. This enables session cookie theft, account takeover, and further compromise of the affected e-commerce platform.

Critical Impact
Authenticated customers can execute arbitrary JavaScript in the browsers of shop owners and administrators, leading to session hijacking and administrative account takeover.

Affected Products

ReadyEcommerce versions prior to 4.5.2
ReadyEcommerce Complete Multi-Vendor E-commerce Mobile App and Website
Rider App and Seller App components sharing the vulnerable Vue components

Discovery Timeline

2026-08-10 - CVE-2026-63105 published to NVD
2026-08-10 - Last updated in NVD database

Technical Details for CVE-2026-63105

Vulnerability Analysis

The vulnerability is a stored cross-site scripting flaw classified under [CWE-79]. ReadyEcommerce uses Vue.js on the front end and renders message content through the v-html directive. This directive injects the string as raw HTML into the DOM, bypassing Vue's default text interpolation, which would otherwise escape HTML entities. Because the application stores customer-submitted chat messages and support ticket replies without server-side sanitization, any HTML or script content persists in the database. When staff users open the affected views, the browser parses the stored payload as markup and executes any embedded JavaScript.

The exploitation path requires only a low-privilege authenticated customer account. Since the payload is stored, delivery does not depend on tricking the victim into clicking a crafted link. Any administrator or shop owner who reviews the conversation will trigger execution automatically.

Root Cause

The root cause is the use of Vue.js v-html to render untrusted user input across four components: Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue. Neither the client nor the server strips or escapes HTML tags, event handlers, or <script> elements before rendering. The application treats user-generated message content as trusted markup.

Attack Vector

An attacker registers or uses an existing customer account. The attacker opens a chat session or submits a support ticket and includes an HTML payload containing JavaScript in the message body. The payload is stored in the ReadyEcommerce backend. When a shop owner or administrator opens the conversation, the vulnerable Vue components render the payload via v-html, executing the injected script. The script can exfiltrate document.cookie, perform actions using the admin session, or pivot to backend administrative endpoints.

No verified public exploit code is available. Technical detail is documented in the VulnCheck Advisory on XSS.

Detection Methods for CVE-2026-63105

Indicators of Compromise

Chat or support ticket message records containing HTML tags such as <script>, <img onerror=...>, <svg onload=...>, or <iframe>.
Outbound HTTP requests from administrator browsers to unfamiliar external hosts shortly after opening a support ticket.
Administrator session tokens observed in use from unexpected IP addresses or geographies.
Unusual privileged actions in ReadyEcommerce audit logs that follow a message-view event.

Detection Strategies

Query the message and support ticket database tables for entries containing angle brackets, on*= event handler attributes, javascript: URIs, or base64-encoded script payloads.
Deploy a Content Security Policy report-only header to identify inline script execution and script-src violations in administrator sessions.
Correlate customer message submissions with subsequent admin session anomalies in web server logs.

Monitoring Recommendations

Alert on new administrator sessions established from IP addresses that differ from historical baselines.
Monitor for cookie or token exfiltration patterns using web application firewall (WAF) response inspection.
Track staff account activity following each support ticket view to detect automated post-exploitation actions.

How to Mitigate CVE-2026-63105

Immediate Actions Required

Upgrade ReadyEcommerce to version 4.5.2 or later, which addresses the unsanitized v-html rendering.
Audit existing chat and support ticket records for stored HTML payloads and purge or neutralize suspicious entries.
Rotate administrator and shop owner session tokens and force re-authentication for all privileged accounts.
Review privileged account activity for the period between the vulnerability's introduction and patch deployment.

Patch Information

The vendor addresses this vulnerability in ReadyEcommerce 4.5.2. Refer to the Codecanyon E-commerce App product page for the current release and to the VulnCheck Advisory on XSS for advisory details.

Workarounds

Replace v-html bindings in Messages.vue, RightChatSidebar.vue, SupportTicketMessages.vue, and SupportTicketDetails.vue with text interpolation ({{ }}) if a source-level fix is required before upgrading.
Introduce server-side HTML sanitization using an allow-list library before persisting chat and support ticket content.
Deploy a strict Content Security Policy that blocks inline scripts and restricts script sources to trusted origins.
Restrict staff access to the support console to hardened workstations and enforce short-lived session cookies with the HttpOnly and Secure flags.

bash

# Example Content-Security-Policy header to reduce XSS impact
add_header Content-Security-Policy "default-src 'self'; script-src 'self'; object-src 'none'; base-uri 'self'; frame-ancestors 'self'";