CVE-2026-75082
Received Received - Intake

Cross-Site Scripting in Webkul Bagisto

Publication date: 2026-08-18

Last updated on: 2026-08-18

Assigner: VulDB

Description
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first_name/last_name causes basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-18
Last Modified
2026-08-18
Generated
2026-08-18
AI Q&A
2026-08-18
EPSS Evaluated
N/A
NVD
CVE-2026-75082
EUVD
EUVD-2026-60559

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
webkul bagisto to 2.4.4 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.
CWE-74 The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a stored cross-site scripting (XSS) flaw in Webkul Bagisto up to version 2.4.4. It allows an attacker to inject malicious HTML or JavaScript code into the first_name and last_name fields during customer registration. The injected code is then rendered in admin notification emails without proper sanitization, potentially deceiving administrators or stealing sensitive information.

Detection Guidance

To detect this vulnerability, inspect HTTP requests to /customer/register for user-supplied first_name and last_name parameters containing HTML or script tags. Check admin email templates for raw user data insertion without encoding. Monitor outgoing emails for unexpected HTML content.

Impact Analysis

If exploited, this vulnerability could allow attackers to manipulate admin emails by inserting fake links, misleading content, or malicious scripts. This may lead to phishing attacks, unauthorized actions performed by admins under false pretenses, or exposure of sensitive data if scripts capture admin credentials or session tokens.

Compliance Impact

This vulnerability could impact compliance by exposing personal data through phishing or unauthorized access, violating GDPR's data protection principles or HIPAA's security requirements for safeguarding sensitive information. Organizations may face penalties if such breaches occur due to inadequate input validation and sanitization.

Mitigation Strategies

Immediately update Bagisto to the latest version addressing this issue. Implement input validation to block HTML in first_name and last_name fields. Escape user data in email templates using proper HTML encoding functions like htmlspecialchars(). Review all notification templates for similar vulnerabilities.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-75082. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart