Description
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first_name/last_name causes basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
Published: 2026-08-18
Score: 5.3 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

Impact

A code flaw in Webkul Bagisto Customer‑Registration Notification Email allows manipulation of the first_name and last_name arguments, causing basic cross‑site scripting that can be triggered remotely. The issue enables an attacker to inject script payloads that execute in a victim’s browser, potentially leading to session hijacking, defacement, or data theft.

Affected Systems

The vulnerability affects Webkul Bagisto versions up to and including 2.4.4. Systems running these releases are impacted regardless of other components, as the vulnerable element is located within the /customer/register file.

Risk and Exploitability

The CVSS score of 5.3 indicates moderate severity. EPSS data is unavailable and the bug is not listed in CISA KEV, suggesting no widespread, automated exploitation presently. Nevertheless, the flaw is remotely exploitable and a proof‑of‑concept has been published, increasing the likelihood of targeted attacks. The absence of a public patch means that unmitigated systems remain at risk until a vendor fix is deployed.

Generated by OpenCVE AI on August 18, 2026 at 01:21 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Verify the Bagisto version installed; versions 2.4.4 and earlier are affected.
  • Wait for and apply the official vendor patch or upgrade to the latest Bagisto release containing the fix as soon as it becomes available.
  • As an interim safeguard, escape or validate all user input for first_name and last_name fields and encode output before rendering in the registration notification email.

Generated by OpenCVE AI on August 18, 2026 at 01:21 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 18 Aug 2026 00:15:00 +0000

Type Values Removed Values Added
Description A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first_name/last_name causes basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
Title Webkul Bagisto Customer-Registration Notification Email register cross site scripting
First Time appeared Webkul
Webkul bagisto
Weaknesses CWE-74
CWE-80
CPEs cpe:2.3:a:webkul:bagisto:*:*:*:*:*:*:*:*
Vendors & Products Webkul
Webkul bagisto
References
Metrics cvssV2_0

{'score': 5, 'vector': 'AV:N/AC:L/Au:N/C:N/I:P/A:N/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 4.3, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 4.3, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 5.3, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Webkul Bagisto
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-08-18T00:00:12.707Z

Reserved: 2026-08-17T16:16:27.594Z

Link: CVE-2026-75082

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-08-18T00:16:53.867

Modified: 2026-08-18T00:16:53.867

Link: CVE-2026-75082

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-08-18T01:30:05Z

Weaknesses
  • CWE-74

    Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

  • CWE-80

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)