This vulnerability in Webkul Bagisto up to version 2.4.4 allows an attacker to perform cross-site scripting via the Message argument in the RMA Message Handler component's /customer/account/rma/send-message endpoint. The vendor has confirmed prior internal identification and partial remediation of the issue, with further fixes planned. The vulnerability is remotely exploitable and publicly disclosed, but no active exploitation is currently known.

Successful exploitation could allow an attacker to execute arbitrary scripts in the context of the affected user's browser, potentially leading to session hijacking, defacement, or other malicious actions within the scope of the vulnerable web application. The impact is rated medium with a CVSS 4.0 score of 5.1, reflecting the potential for limited user interaction and privileges required.

The vendor has internally identified and partially addressed the vulnerability, with remaining fixes planned for upcoming product releases. No official patch or update is currently publicly available. Users should monitor vendor communications for forthcoming updates and apply them once released. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.