Stored XSS Vulnerability in Bagisto E-commerce Platform
CVE-2026-121733

2.1LOW

Key Information:

Vendor

Webkul

Status
Bagisto
Vendor
CVE Published:
3 November 2026

What is CVE-2026-121733?

Bagisto versions prior to 2.4.5 are susceptible to a stored cross-site scripting vulnerability. This flaw arises from the lack of proper validation for HTML file uploads via the RMA send-message endpoint. Authenticated users can upload HTML files, which may contain malicious JavaScript code. When an administrator opens these attachments, the embedded scripts can execute within the context of the shop's origin, potentially leading to unauthorized actions and data exposure.

Affected Version(s)

Bagisto 0 < 2.4.5

References

https://github.com/bagisto/bagisto/commit/204e43c26705b66...
patch
https://github.com/bagisto/bagisto
product
https://github.com/bagisto/bagisto/commit/e28db3e8c53a94a...
patch

CVSS V4

Score:
2.1
Severity:
LOW
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Muhammad Shariff
Devansh Bawari
.