Login Request a demo
BA
Product
Bagisto
by Webkul · last CVE Sep 28, 2026
36
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities36In the news0Timeline
Severity mix
Critical 3High 10Medium 19Low 4
Severity
All severities36Critical3High10Medium19Low4
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Bagisto to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2025-62416
6.8
0%
Oct 16
bagisto - Server Side Template Injection (SSTI) in Product Description
Affected: 2.3.7
CVE-2025-56426
6.5
0%
Oct 9
An issue WebKul Bagisto v.2.3.6 allows a remote attacker to execute arbitrary code via the Cart/Checkout API endpoint, specifically, the price calculation logic fails to validate…
Affected: 2.3.6
CVE-2023-36238
6.5
1%
Mar 13
Insecure Direct Object Reference (IDOR) in Bagisto v.1.5.1 allows an attacker to obtain sensitive information via the invoice ID parameter
Affected: 1.5.1
CVE-2024-27499
6.5
1%
Mar 1
Bagisto v1.5.1 is vulnerable for Cross site scripting(XSS) via png file upload vulnerability in product review option
Affected: 1.5.1
CVE-2026-19994
6.3
0%
Aug 17
Webkul Bagisto Configuration Management execute authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2025-40675
6.1
0%
Jun 9
A Reflected Cross-Site Scripting (XSS) vulnerability has been found in Bagisto v2.0.0
Affected: 2.0.0 before 2.2.3
CVE-2026-60120
5.4
0%
Jul 9
Bagisto < 2.4.4 Stored XSS via CSTI in create.blade.php
Affected: before 2.4.4
CVE-2025-62415
4.8
0%
Oct 16
bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (HTML)
Affected: 2.3.7
CVE-2025-62418
4.8
0%
Oct 16
bagisto - Cross Site Scripting (XSS) in TinyMCE Image Upload (SVG)
Affected: 2.3.7
CVE-2025-62414
4.8
0%
Oct 16
bagisto - Cross Site Scripting (XSS) in Create New Customer
Affected: 2.3.7
CVE-2023-36236
4.8
1%
Jan 16
Cross Site Scripting vulnerability in webkil Bagisto v.1.5.0 and before allows an attacker to execute arbitrary code via a crafted SVG file uplad
Affected: through 1.5.0
CVE-2026-19997
4.7
0%
Aug 17
Webkul Bagisto Backend Sales RMA Endpoint requests authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19834
4.7
0%
Aug 14
Webkul Bagisto Admin Customer Impersonation Feature login-as-customer authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-75082
4.3
0%
Aug 18
Webkul Bagisto Customer-Registration Notification Email register cross site scripting
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-75081
4.3
0%
Aug 17
Webkul Bagisto store behavioral workflow
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19996
4.3
0%
Aug 17
Webkul Bagisto Backend Customer Behavior Data Endpoint customers privileges management
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19993
4.3
0%
Aug 17
Webkul Bagisto RMA State Validation update-status behavioral workflow
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19838
4.3
0%
Aug 14
Webkul Bagisto Backend Reporting Endpoint sales authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
CVE-2026-19836
4.3
0%
Aug 14
Webkul Bagisto Backend Customer Detail Feature view authorization
Affected: 2.4.0; 2.4.1; 2.4.2; 2.4.3; 2.4.4
Showing 19