CVE-2026-19995: Cross Site Scripting in Webkul Bagisto
A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
AI Analysis
Technical Summary
Webkul Bagisto versions up to 2.4.4 contain a cross-site scripting vulnerability in the RMA Message Handler component, specifically in the /customer/account/rma/send-message endpoint. The vulnerability arises from improper sanitization of the Message argument, enabling remote attackers with limited privileges to inject malicious scripts. The vendor has internally identified and partially addressed the issue prior to public disclosure, with further fixes planned in upcoming releases. No public exploit is known to be actively used in the wild, and the CVSS 3.1 base score is 3.5 (low severity).
Potential Impact
The vulnerability allows remote attackers with limited privileges to perform cross-site scripting attacks by manipulating the Message argument in the RMA Message Handler. This could lead to limited impact such as user interface manipulation or session hijacking in the context of the affected application. There is no indication of confidentiality or availability impact. The low CVSS score reflects the limited scope and required user interaction.
Mitigation Recommendations
The vendor has already addressed some of the issues internally and plans to resolve remaining items in upcoming product releases. No official patch or version update is currently publicly available. Users should monitor vendor advisories for forthcoming updates and apply them once released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
CVE-2026-19995: Cross Site Scripting in Webkul Bagisto
Description
A vulnerability was determined in Webkul Bagisto up to 2.4.4. This affects an unknown part of the file /customer/account/rma/send-message of the component RMA Message Handler. This manipulation of the argument Message causes cross site scripting. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor confirms: "The reported issues were already identified through our internal security assessment process prior to this notification and are being handled through our established internal security and development lifecycle. Some of these items have already been addressed, while the remaining items are planned for resolution in upcoming product releases."
CVSS v4.0
Score 5.1medium
Affected software
Run on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Webkul Bagisto versions up to 2.4.4 contain a cross-site scripting vulnerability in the RMA Message Handler component, specifically in the /customer/account/rma/send-message endpoint. The vulnerability arises from improper sanitization of the Message argument, enabling remote attackers with limited privileges to inject malicious scripts. The vendor has internally identified and partially addressed the issue prior to public disclosure, with further fixes planned in upcoming releases. No public exploit is known to be actively used in the wild, and the CVSS 3.1 base score is 3.5 (low severity).
Potential Impact
The vulnerability allows remote attackers with limited privileges to perform cross-site scripting attacks by manipulating the Message argument in the RMA Message Handler. This could lead to limited impact such as user interface manipulation or session hijacking in the context of the affected application. There is no indication of confidentiality or availability impact. The low CVSS score reflects the limited scope and required user interaction.
Mitigation Recommendations
The vendor has already addressed some of the issues internally and plans to resolve remaining items in upcoming product releases. No official patch or version update is currently publicly available. Users should monitor vendor advisories for forthcoming updates and apply them once released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.
Technical Details
- Gcve Source
- db.gcve.eu
- Osv Id
- GHSA-w558-j9mq-crm3
- Osv Schema Version
- 1.4.0
- Aliases
- ["CVE-2026-19995"]
- Database Specific Severity
- LOW
- Cvss Version
- 3.1
Threat ID: 6a83336fbf8831d5392a82c9
Added to database: 08/17/2026, 16:14:39 UTC
Last enriched: 08/17/2026, 16:36:21 UTC
Last updated: 10/02/2026, 19:59:13 UTC
Views: 58
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.