What’s Vulnerable › Vulnerabilities

CVE-2025-62415: bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)

• Severity: medium (CVSS 4.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.3% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-10-16 · updated 2026-10-19
• Weakness: CWE-80

Description

Bagisto is an open source laravel eCommerce platform. In Bagisto v2.3.7, the TinyMCE image upload functionality allows an attacker with sufficient privileges (e.g. admin) to upload a crafted HTML file containing embedded JavaScript. When viewed, the malicious code executes in the context of the admin/user’s browser. This vulnerability is fixed in 2.3.8.

Affected products

• Webkul Bagisto: 2.3.7

References

• https://github.com/bagisto/bagisto/security/advisories/GHSA-67px-r26w-598x
• https://github.com/bagisto/bagisto/security/advisories/GHSA-67px-r26w-598x

Get alerted when CVE-2025-62415 or the next vulnerability affects your stack