bagisto vulnerabilities
CVEs whose affected-version data names the bagisto package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
3 CVEsRSS
CVE-2026-121733Medium· 5.4Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload
Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows authenticated customers to upload HTML files via the RMA send-message endpoint without type or extension validation. Attackers can upload a .html attac…
CVE-2026-121628Low· 3.7PoCBagisto before 2.3.16 and 2.4.x before 2.4.1 Race Condition in Coupon Usage Accounting
Bagisto before 2.3.16 and 2.4.x before 2.4.1 contains a race condition vulnerability in manageCartRule() that allows attackers to redeem single-use coupons multiple times. Attackers can submit concurrent order requests to the onepage ord…
CVE-2026-101139Low· 2.7PoCA vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4
A vulnerability was detected in Webkul Bagisto up to 2.4.6/2.5.0-beta4. This impacts an unknown function of the file /admin/sales/invoices/mass-update/state of the component Invoice Mass Status Update. Performing a manipulation results i…