The vulnerability in Bagisto prior to version 2.4.4 is a stored cross-site scripting issue caused by client-side template injection. Attackers can exploit this by registering a customer account with malicious JavaScript payloads embedded in the first or last name fields. The create.blade.php template fails to use the Vue.js v-pre directive, which prevents Vue.js from compiling template expressions. As a result, when an administrator opens the Create Order page for the affected customer, the malicious payload is executed in the administrator's browser context.

Successful exploitation allows unauthenticated attackers to execute arbitrary JavaScript in administrator browsers. This can lead to session hijacking, unauthorized actions performed with administrator privileges, or other malicious activities within the administrator's session. The vulnerability affects the confidentiality and integrity of the administrator's session and potentially the entire application.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, administrators should exercise caution when handling new customer accounts and consider additional input validation or sanitization on the server side. Monitoring for suspicious account registrations with unusual characters in name fields may help detect exploitation attempts.