Sign in
Deutsch English Español Polski
Low

Bagisto affected by Cross-site Scripting

  • Disclosed: 21.04.2026
  • Updated: 11.10.2026 10:22

A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and explained: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."

Affected software

Click a technology to see all vulnerabilities affecting it.

PlatformPackageVulnerable versionsFixed in
Composer package bagisto/bagisto <= 2.3.15 no fix

References

CVSS score 3.5/10
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N
Weakness (CWE)
CWE-79
Platform
Composer
Package
bagisto/bagisto
Disclosed
21.04.2026
Updated
11.10.2026 10:22

Sources and licenses

OSV / GitHub Advisory Database - GHSA-65fp-7g2v-658r - CC BY 4.0

Vulnerability history: bagisto/bagisto

All published vulnerabilities of this package (Composer package), newest first. Shows whether this is a one-off slip or a package that needs watching.

All (20) in the archive
Total entries
20
First → latest
11.2019 04.2026
Without a fix
2
Exploited in attacks
0

Severity breakdown

  • Critical 1
  • High 8
  • Medium 9
  • Low 2

Disclosures per year

Severity:
  1. Bagisto affected by Cross-site Scripting this entry
    Low · 3.5 CVE-2026-6745 <= 2.3.15 no fix
  2. Bagisto is vulnerable to SSTI via name parameters provided by non-admin low-privilege users
    High · 8.8 CVE-2026-21449 < 2.3.10 2.3.10
  3. Bagisto has IDOR in Customer Order Reorder Functionality
    High · 7.1 CVE-2026-21447 < 2.3.10 2.3.10
  4. Bagisto has Normal & Blind SSTI from low-privilege user when ordering product
    High · 9.8 CVE-2026-21448 < 2.3.10 2.3.10
  5. Bagisto SSTI vulnerability in type parameter can lead to RCE
    High CVE-2026-21450 < 2.3.10 2.3.10
  6. Bagisto Missing Authentication on Installer API Endpoints
    High · 9.8 CVE-2026-21446 >= 2.3.0, < 2.3.10 2.3.10
  7. bagisto has CSV Formula Injection in Create New Product
    Critical · 9.0 CVE-2025-62417 < 2.3.8 2.3.8
  8. Bagisto is vulnerable to XSS through Admin Panel's product creation path
    High · 8.3 CVE-2025-60880 >= 2.3.6, < 2.3.7 2.3.7
  9. Bagisto Cross-Site Request Forgery vulnerability
    High · 8.8 CVE-2023-36237 < 1.3.2 1.3.2
  10. Bagisto CSRF Vulnerability
    High · 8.8 CVE-2019-14933 < 0.1.5 0.1.5

Know which vulnerabilities affect your application

With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.

Connect your application
DockRay newsletter

Application security in your inbox

Important vulnerabilities, actionable guidance and practical advice for your applications. Choose your technologies and follow what matters to your project.

  • A daily digest of new vulnerabilities, critical ones included.
  • Notifications about important updates.
  • Practical advice on application security and monitoring.

Leave empty to receive updates for every technology.

Privacy policy

Free to subscribe. Unsubscribe with one click in any email.