Cross-Site Scripting Vulnerability in Webkul Bagisto Customer Registration Email
CVE-2026-75082

5.3MEDIUM

Key Information:

Vendor: Webkul
Status: Bagisto
Vendor: CVE Published:; 18 August 2026

Badges

👾 Exploit Exists🟡 Public PoC

What is CVE-2026-75082?

A security flaw has been identified in Webkul Bagisto affecting versions up to 2.4.4. The vulnerability resides in the customer registration notification email component, particularly due to improper handling of input parameters 'first_name' and 'last_name'. This oversight enables attackers to exploit cross-site scripting (XSS), allowing remote execution of malicious scripts in the user's browser. The vendor acknowledges the issue and has confirmed that it was detected through their internal security assessments, with measures already in place for remediation in upcoming releases. Users are encouraged to apply patches or updates as they become available to safeguard against potential exploits.

Affected Version(s)

Bagisto 2.4.0

Bagisto 2.4.1

Bagisto 2.4.2

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2026-75082 - Proof of Concept