CVE-2026-75082: Webkul Bagisto Customer-Registration Notification Email register cross site scripting
A flaw has been found in Webkul Bagisto up to 2.4.4. The affected element is an unknown function of the file /customer/register of the component Customer-Registration Notification Email. This manipulation of the argument firstname/lastname causes basic cross site scripting. It is possible to initiate the attack remotely. The exploit has been published and may be used. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Compensating control
Because the vendor states the flaw allows remote exploitation and a basic cross site scripting via the first_name/last_name argument in Webkul Bagisto Customer-Registration Notification Email (/customer/register), place the affected instance behind compensating protections such as a WAF/edge filtering rules that block XSS payloads targeting parameters first_name and last_name until the fix is released.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-75082?
The severity of CVE-2026-75082 is medium with a score of 4.3.
How do I fix CVE-2026-75082?
To fix CVE-2026-75082, update your Webkul Bagisto installation to version 2.4.5 or later.
What components are affected by CVE-2026-75082?
CVE-2026-75082 affects the Customer-Registration Notification Email feature in Webkul Bagisto versions up to 2.4.4.
What type of vulnerability is CVE-2026-75082?
CVE-2026-75082 is a cross site scripting (XSS) vulnerability.
Who is impacted by CVE-2026-75082?
Users of Webkul Bagisto who utilize the customer registration feature are impacted by CVE-2026-75082.