What’s Vulnerable › Products
Webkul Bagisto vulnerabilities
36 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 29 published in the last 12 months.
Check whether your Webkul Bagisto version is affected
Latest Webkul Bagisto vulnerabilities
- CVE-2026-101139 — Webkul Bagisto Invoice Mass Status Update state authorization (CVSS 2.7)
- CVE-2026-75082 — Webkul Bagisto Customer-Registration Notification Email register cross site scripting (CVSS 4.3)
- CVE-2026-75081 — Webkul Bagisto store behavioral workflow (CVSS 4.3)
- CVE-2026-19997 — Webkul Bagisto Backend Sales RMA Endpoint requests authorization (CVSS 4.7)
- CVE-2026-19996 — Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management (CVSS 4.3)
- CVE-2026-19995 — Webkul Bagisto RMA Message send-message cross site scripting (CVSS 3.5)
- CVE-2026-19994 — Webkul Bagisto Configuration Management execute authorization (CVSS 6.3)
- CVE-2026-19993 — Webkul Bagisto RMA State Validation update-status behavioral workflow (CVSS 4.3)
- CVE-2026-19838 — Webkul Bagisto Backend Reporting Endpoint sales authorization (CVSS 4.3)
- CVE-2026-19837 — Webkul Bagisto Customer Search search information disclosure (CVSS 2.7)
- CVE-2026-19836 — Webkul Bagisto Backend Customer Detail Feature view authorization (CVSS 4.3)
- CVE-2026-19835 — Webkul Bagisto Customer Item Deletion Endpoint access control (CVSS 3.8)
- CVE-2026-19834 — Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization (CVSS 4.7)
- CVE-2026-60120 — Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php (CVSS 5.4)
- CVE-2026-9506 — Path Traversal Vulnerability in Bagisto (CVSS 8.7)
- CVE-2026-21451 — Bagisto has HTML Filter Bypass that Enables Stored XSS (CVSS 8.4)
- CVE-2026-21450 — Bagisto has SSTI in parameter that can lead to RCE (CVSS 9.8)
- CVE-2026-21449 — Bagisto has SSTI via first and last name from low-privilege user (not admin) (CVSS 8.8)
- CVE-2026-21448 — Bagisto has Normal & Blind SSTI from low-privilege user when ordering product (CVSS 9.8)
- CVE-2026-21447 — Bagisto has IDOR in Customer Order Reorder Functionality (CVSS 7.1)
- CVE-2026-21446 — Bagisto Missing Authentication on Installer API Endpoints (CVSS 9.8)
- CVE-2025-62418 — bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG) (CVSS 4.8)
- CVE-2025-62417 — bagisto - CSV Formula Injection in Create New Product (CVSS 7.8)
- CVE-2025-62416 — bagisto - Server Side Template Injection (SSTI) in Product Description (CVSS 6.8)
- CVE-2025-62415 — bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML) (CVSS 4.8)