Bagisto
Webkul- Product type
- Other
- Catalog vulnerabilities
- 35
Severity across 14 analyzed records
en
Verify to analyze this security profile
As of 09/13/2026, within CyStack's analyzed data, Bagisto has 13 security vulnerabilities published in the last 90 days. Of these, 0 are rated High or Critical. None of these vulnerabilities is listed in the CISA KEV catalog. CyStack recommends that organizations and individual users remediate applicable vulnerabilities as soon as possible.
CyStack does not yet have sufficient official-source data to identify the latest version of Bagisto and determine which vulnerabilities affect that version.
| Vulnerability | Exploitation status | Fix | Published | Severity |
|---|---|---|---|---|
CVE-2026-75082Webkul Bagisto Customer-Registration Notification Email register cross site scripting | Exploitation statusPublic exploit | FixNot confirmed | Published08/18/2026 | SeverityMedium |
CVE-2026-75081Webkul Bagisto store behavioral workflow | Exploitation statusPublic exploit | FixNot confirmed | Published08/17/2026 | SeverityMedium |
CVE-2026-19997Webkul Bagisto Backend Sales RMA Endpoint requests authorization | Exploitation statusPublic exploit | FixNot confirmed | Published08/17/2026 | SeverityMedium |
CVE-2026-19996Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management | Exploitation statusPublic exploit | FixNot confirmed | Published08/17/2026 | SeverityMedium |
CVE-2026-19995Webkul Bagisto RMA Message send-message cross site scripting | Exploitation statusPublic exploit | FixNot confirmed | Published08/17/2026 | SeverityMedium |
CVE-2026-19994Webkul Bagisto Configuration Management execute authorization | Exploitation statusPublic exploit | FixNot confirmed | Published08/17/2026 | SeverityMedium |
CVE-2026-19993Webkul Bagisto RMA State Validation update-status behavioral workflow | Exploitation statusPublic exploit | FixNot confirmed | Published08/17/2026 | SeverityMedium |
CVE-2026-19838Webkul Bagisto Backend Reporting Endpoint sales authorization | Exploitation statusPublic exploit | FixNot confirmed | Published08/14/2026 | SeverityMedium |
CVE-2026-19837Webkul Bagisto Customer Search search information disclosure | Exploitation statusPublic exploit | FixNot confirmed | Published08/14/2026 | SeverityMedium |
CVE-2026-19836Webkul Bagisto Backend Customer Detail Feature view authorization | Exploitation statusPublic exploit | FixNot confirmed | Published08/14/2026 | SeverityMedium |
CVE-2026-19835Webkul Bagisto Customer Item Deletion Endpoint access control | Exploitation statusPublic exploit | FixNot confirmed | Published08/14/2026 | SeverityMedium |
CVE-2026-19834Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization | Exploitation statusPublic exploit | FixNot confirmed | Published08/14/2026 | SeverityMedium |
CVE-2026-60120Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php | Exploitation statusNot known exploited | FixYes | Published07/09/2026 | SeverityMedium |
CVE-2026-9506Path Traversal Vulnerability in Bagisto | Exploitation statusNot known exploited | FixYes | Published06/08/2026 | SeverityHigh |
CVE-2026-21450Bagisto has SSTI in parameter that can lead to RCE | Exploitation statusNot known exploited | FixNot confirmed | Published01/02/2026 | SeverityHigh |
CVE-2026-21451Bagisto has HTML Filter Bypass that Enables Stored XSS | Exploitation statusPublic exploit | FixNot confirmed | Published01/02/2026 | SeverityMedium |
CVE-2026-21449Bagisto has SSTI via first and last name from low-privilege user (not admin) | Exploitation statusPublic exploit | FixNot confirmed | Published01/02/2026 | SeverityHigh |
CVE-2026-21448Bagisto has Normal & Blind SSTI from low-privilege user when ordering product | Exploitation statusPublic exploit | FixNot confirmed | Published01/02/2026 | SeverityHigh |
CVE-2026-21447Bagisto has IDOR in Customer Order Reorder Functionality | Exploitation statusPublic exploit | FixNot confirmed | Published01/02/2026 | SeverityHigh |
CVE-2026-21446Bagisto Missing Authentication on Installer API Endpoints | Exploitation statusNot known exploited | FixNot confirmed | Published01/02/2026 | SeverityHigh |
CVE-2025-62415bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML) | Exploitation statusPublic exploit | FixYes | Published10/16/2025 | SeverityMedium |
CVE-2025-62418bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG) | Exploitation statusPublic exploit | FixYes | Published10/16/2025 | SeverityMedium |
CVE-2025-62414bagisto - Cross Site Scripting (XSS) in Create New Customer | Exploitation statusPublic exploit | FixYes | Published10/16/2025 | SeverityMedium |
CVE-2025-62416bagisto - Server Side Template Injection (SSTI) in Product Description | Exploitation statusPublic exploit | FixYes | Published10/16/2025 | SeverityMedium |
CVE-2025-62417bagisto - CSV Formula Injection in Create New Product | Exploitation statusPublic exploit | FixYes | Published10/16/2025 | SeverityHigh |
CVE-2025-60880 | Exploitation statusPublic exploit | FixNot confirmed | Published10/10/2025 | SeverityHigh |
CVE-2025-56426 | Exploitation statusPublic exploit | FixNot confirmed | Published10/09/2025 | SeverityMedium |
CVE-2025-40675Reflected Cross-Site Scripting (XSS) in Bagisto | Exploitation statusNot known exploited | FixNot confirmed | Published06/09/2025 | SeverityMedium |
CVE-2023-36238 | Exploitation statusNot known exploited | FixNot confirmed | Published03/13/2024 | SeverityMedium |
CVE-2024-27499 | Exploitation statusPublic exploit | FixNot confirmed | Published03/01/2024 | SeverityMedium |
CVE-2023-36237 | Exploitation statusNot known exploited | FixNot confirmed | Published02/26/2024 | SeverityHigh |
CVE-2023-36236 | Exploitation statusPublic exploit | FixNot confirmed | Published01/16/2024 | SeverityMedium |
CVE-2023-33570 | Exploitation statusPublic exploit | FixNot confirmed | Published06/28/2023 | SeverityUnknown |
CVE-2019-16403 | Exploitation statusNot confirmed | FixNot confirmed | Published09/18/2019 | SeverityUnknown |
CVE-2019-14933 | Exploitation statusNot confirmed | FixNot confirmed | Published08/11/2019 | SeverityUnknown |
CyStack VulnScan continuously discovers assets, validates vulnerabilities, and helps security teams prioritize remediation across the organization.
Explore CyStack VulnScan