CVE-2026-19995
Received Received - Intake

Cross-Site Scripting in Webkul Bagisto

Publication date: 2026-08-17

Last updated on: 2026-08-17

Assigner: VulDB

Description
A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-17
Last Modified
2026-08-17
Generated
2026-08-17
AI Q&A
2026-08-17
EPSS Evaluated
N/A
NVD
CVE-2026-19995
EUVD
EUVD-2026-60061

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webkul bagisto to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-19995 is a stored cross-site scripting (XSS) vulnerability in Bagisto version 2.4.4. It allows a logged-in frontend customer to inject malicious HTML or JavaScript into RMA (Return Merchandise Authorization) conversation messages. The server stores the raw message without proper validation, and both frontend and backend views render it unsafely using v-html, executing the injected script.

Detection Guidance

To detect this vulnerability, inspect Bagisto instances running version 2.4.4 or earlier for RMA message handling. Check if user-provided messages in /customer/account/rma/send-message are stored without server-side sanitization and rendered using v-html. Look for unusual HTML or JavaScript in stored messages.

Impact Analysis

This vulnerability allows attackers to execute scripts in the context of other users, including backend administrators. Potential impacts include theft of sensitive data, triggering privileged actions, or compromising admin sessions. Attackers could manipulate RMA messages to perform unauthorized actions on behalf of users.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles and HIPAA's security requirements. It may result in data breaches, unauthorized disclosure of personal or health information, and failure to maintain data integrity and confidentiality.

Mitigation Strategies

Disable or restrict RMA message functionality until patched. Implement server-side input sanitization for all user messages. Replace v-html rendering with plain text output. Upgrade Bagisto to a version addressing this issue as soon as available.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19995. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart