Description

A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "3.5",
  "pubDate": "2026-08-17T07:17:15.323Z",
  "pubdate": "2026-08-17T07:17:15.323Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability has been identified in Webkul Bagisto up to version 2.4.4, specifically within the RMA Message Handler component. The vulnerability resides in the handling of the Message argument processed via the endpoint /customer/account/rma/send-message. This flaw allows remote attackers to inject malicious client-side scripts into the application context due to insufficient input sanitization and output encoding. The primary impact of this vulnerability includes session hijacking, credential theft, and unauthorized actions performed on behalf of authenticated users within the affected application. Remote exploitation is viable, and public disclosure of the exploit increases the risk of active targeting by malicious actors. The vendor has acknowledged the issue, stating that these items were previously identified during internal security assessments and are being managed through their development lifecycle, with some fixes already deployed and remaining resolutions planned for future product releases.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw affecting the RMA Message Handler component of Webkul Bagisto up to version 2.4.4. Specifically, the root cause stems from the improper neutralization of user-supplied input submitted through the Message argument within HTTP requests sent to the /customer/account/rma/send-message file path. When a user or remote attacker submits a specially crafted payload containing malicious JavaScript or HTML tags into the vulnerable Message parameter, the application fails to perform adequate context-aware output encoding or strict input sanitization before rendering the data back to the DOM or storing it for administrative and customer review.\nThe attack flow typically initiates when an unauthenticated or authenticated remote attacker crafts an HTTP POST or GET request directed at the /customer/account/rma/send-message endpoint. The malicious payload embedded within the Message argument is processed by the backend RMA Message Handler and subsequently persisted or reflected within the Return Merchandise Authorization (RMA) communication interface. When a victim—such as a privileged support agent or another customer viewing the RMA message thread—loads the affected page, the malicious script is executed within the context of their browser session. Because the script executes in the victim's browser session, it inherits their authentication state and session privileges.\nNetwork exposure for this vulnerability is remote, as the targeted endpoint is accessible via standard web protocols over the internet. Depending on the specific implementation of the RMA messaging interface, exploitation may require authentication as a customer to access the RMA messaging feature, or it could potentially leverage lack of robust access controls. The payload behavior involves executing arbitrary JavaScript code, which can facilitate session token exfiltration, DOM tampering, redirection to malicious external domains, or the execution of unauthorized transactional requests within the Bagisto application environment. Post-exploitation impact heavily relies on the privilege level of the victim viewing the injected message thread, potentially escalating to administrative takeover if an administrator reviews the compromised RMA ticket."
}