Webkul Bagisto versions up to 2.4.4 contain a cross-site scripting vulnerability in the RMA Message Handler component, specifically in the /customer/account/rma/send-message endpoint. The vulnerability arises from improper sanitization of the Message argument, enabling remote attackers with limited privileges to inject malicious scripts. The vendor has internally identified and partially addressed the issue prior to public disclosure, with further fixes planned in upcoming releases. No public exploit is known to be actively used in the wild, and the CVSS 3.1 base score is 3.5 (low severity).

The vulnerability allows remote attackers with limited privileges to perform cross-site scripting attacks by manipulating the Message argument in the RMA Message Handler. This could lead to limited impact such as user interface manipulation or session hijacking in the context of the affected application. There is no indication of confidentiality or availability impact. The low CVSS score reflects the limited scope and required user interaction.

The vendor has already addressed some of the issues internally and plans to resolve remaining items in upcoming product releases. No official patch or version update is currently publicly available. Users should monitor vendor advisories for forthcoming updates and apply them once released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.