Webkul Bagisto

• CVE-2026-121733 Medium 5.4 Bagisto before 2.4.5 Stored XSS via RMA Conversation Attachment Upload 0.2%
• CVE-2026-101139 Low 2.7 Webkul Bagisto Invoice Mass Status Update state authorization 0.3%
• CVE-2026-75082 Medium 4.3 Webkul Bagisto Customer-Registration Notification Email register cross site scripting 0.4%
• CVE-2026-75081 Medium 4.3 Webkul Bagisto store behavioral workflow 0.4%
• CVE-2026-19997 Medium 4.7 Webkul Bagisto Backend Sales RMA Endpoint requests authorization 0.4%
• CVE-2026-19996 Medium 4.3 Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management 0.4%
• CVE-2026-19995 Low 3.5 Webkul Bagisto RMA Message send-message cross site scripting 0.3%
• CVE-2026-19994 Medium 6.3 Webkul Bagisto Configuration Management execute authorization 0.4%
• CVE-2026-19993 Medium 4.3 Webkul Bagisto RMA State Validation update-status behavioral workflow 0.4%
• CVE-2026-19838 Medium 4.3 Webkul Bagisto Backend Reporting Endpoint sales authorization 0.4%
• CVE-2026-19837 Low 2.7 Webkul Bagisto Customer Search search information disclosure 0.4%
• CVE-2026-19836 Medium 4.3 Webkul Bagisto Backend Customer Detail Feature view authorization 0.4%
• CVE-2026-19835 Low 3.8 Webkul Bagisto Customer Item Deletion Endpoint access control 0.5%
• CVE-2026-19834 Medium 4.7 Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization 0.4%
• CVE-2026-60120 Medium 5.4 Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php 0.4%
• CVE-2026-9506 High 8.7 Path Traversal Vulnerability in Bagisto 1.4%