CVE-2026-75082
MediumCVSS 4.3Exploitation Probability (EPSS)
Low risk26th percentile - higher than 26% of all known CVEs
Summary
A basic cross-site scripting (XSS) vulnerability was found in Webkul Bagisto up to 2.4.4 in the file /customer/register, in the Customer-Registration Notification Email component. Manipulation of the first_name/last_name arguments allows remote attack. The exploit has been published and may be used. The vendor confirms the issues were already identified internally and are being addressed.
Risk Assessment
An attacker can inject malicious scripts into the first and last name fields, potentially leading to session theft, account takeover, or spreading malicious code among users. The public exploit increases the risk.
Recommendation
Update Bagisto to the latest version when available, and apply input filtering and encoding on the first_name/last_name fields. Temporarily restrict registration access if possible.
Original NVD description (English source)
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first_name/last_name causes basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."