Description

A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument first_name/last_name causes basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.3",
  "pubDate": "2026-08-18T00:16:53.867Z",
  "pubdate": "2026-08-18T00:16:53.867Z",
  "executiveSummary": "A cross-site scripting vulnerability has been identified in Webkul Bagisto up to version 2.4.4, specifically within the Customer-Registration Notification Email component accessed via the /customer/register endpoint.\nThe vulnerability arises from the improper neutralization of user-supplied input within the first_name and last_name parameters, allowing an unauthenticated remote attacker to inject malicious scripts.\nWhen processed and rendered by the application, the injected payload executes within the context of the victim's session, potentially leading to session hijacking, credential theft, or unauthorized actions on behalf of the affected user.\nThe risk implications include compromise of user account integrity and potential exposure of sensitive administrative or customer data if the notification is rendered in a privileged context.\nExploitation requires no prior authentication and can be initiated remotely by supplying malicious payloads during the registration process.\nPublic exploits are currently available, increasing the urgency for defensive measures and patch deployment.",
  "technicalDetails": "The vulnerability is classified as a Cross-Site Scripting (XSS) flaw, stemming from the lack of proper input validation and output encoding on user-controlled parameters.\nThe vulnerable component is the Customer-Registration Notification Email feature, which processes input submitted through the /customer/register endpoint.\nSpecifically, the input vectors affected are the first_name and last_name argument fields processed during user registration.\nNetwork exposure is remote, and the attack vector is accessible over the network without requiring authentication or specific privileges from the attacker.\nThe root cause is insufficient sanitization of input before it is included in email notification templates or administrative views that render the customer's name.\nThe attack flow proceeds as follows: First, an unauthenticated attacker crafts a malicious HTTP POST request to the /customer/register endpoint, embedding a script payload (e.g., JavaScript) within the first_name or last_name parameters. Second, the application accepts the input and stores or processes it to generate the Customer-Registration Notification Email. Third, when the application or an administrator views the generated notification email or associated log/interface containing the unescaped parameters, the browser interprets the input as executable code. Finally, the payload executes within the victim's browser session, allowing the attacker to perform actions within the user's scope, access session tokens, or manipulate the Document Object Model (DOM).\nAffected versions include Webkul Bagisto up to version 2.4.4."
}