Bagisto’s Custom Scripts Handler contains an XSS flaw that allows attackers to inject arbitrary user‑supplied script into pages rendered by the application. The flaw is classified as CWE‑79 and also involves a code injection path (CWE‑94). The vulnerability can be exploited remotely, as announced, giving the attacker the ability to run code in a victim’s browser when the vulnerable content is displayed. No explicit mention of authentication requirements is made in the description.

All installations of Bagisto version 2.3.15 or earlier are affected. The advisory does not enumerate later releases, so any deployment that still includes the vulnerable Custom Scripts Handler before the vendor releases a fix remains at risk.

The CVSS score of 5.1 represents moderate severity. EPSS is unavailable, and the issue is not listed in CISA KEV, indicating no current widespread exploitation. The likely attack vector is a web‑based request to the Custom Scripts endpoint; this inference is made because the description states remote exploitation is possible, but the exact vector is not specified. Attackers could surface the injected script if a user views the affected page.