CVE-2026-6745: Bagisto Custom Scripts cross site scripting
A vulnerability was determined in Bagisto up to 2.3.15. Affected by this vulnerability is an unknown functionality of the component Custom Scripts Handler. This manipulation causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure and explains: "We already replied on the github advisories. All the security issues are addressed through security advisory. We will fix this in our upcomming releases."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2026-6745?
CVE-2026-6745 has been classified as a high severity vulnerability due to the potential for remote exploitation through cross-site scripting.
How do I fix CVE-2026-6745?
To fix CVE-2026-6745, update Bagisto to version 2.3.16 or later, which addresses the cross-site scripting vulnerability.
What versions of Bagisto are affected by CVE-2026-6745?
CVE-2026-6745 affects all versions of Bagisto up to and including 2.3.15.
What type of attack can CVE-2026-6745 enable?
CVE-2026-6745 enables cross-site scripting attacks, allowing attackers to inject malicious scripts into web pages viewed by users.
Can CVE-2026-6745 be exploited remotely?
Yes, CVE-2026-6745 allows for remote exploitation, meaning it can be attacked over the internet without physical access to the system.